{"record":{"id":"d999927087dee09b","repo":"kubernetes/kops","slug":"unable-to-find-created-certificate-q-w","errorCode":null,"errorMessage":"unable to find created certificate %q: %w","messagePattern":"unable to find created certificate %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":235,"sourceCode":"\t\t\tType:           e.Type,\n\t\t\tSubject:        *subjectPkix,\n\t\t\tAlternateNames: e.AlternateNames,\n\t\t}\n\n\t\tkeyset, err := CreateKeyset(ctx, c.T.Keystore, name, req)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating certificate: %v\", err)\n\t\t}\n\n\t\tif err := e.setResources(keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error setting resources: %v\", err)\n\t\t}\n\n\t\t// Make double-sure it round-trips\n\t\tif roundtrip, err := c.T.Keystore.FindKeyset(ctx, name); err != nil {\n\t\t\treturn err\n\t\t} else if roundtrip == nil {\n\t\t\treturn fmt.Errorf(\"unable to find created certificate %q: %w\", name, err)\n\t\t}\n\n\t\tklog.V(8).Infof(\"created certificate with subject %v\", subjectPkix)\n\t}\n\n\t// TODO: Check correct subject / flags\n\n\tif changeStoredFormat {\n\t\t// We fetch and reinsert the same keypair, forcing an update to our preferred format\n\t\t// TODO: We're assuming that we want to save in the preferred format\n\t\tkeyset, err := c.T.Keystore.FindKeyset(ctx, name)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif keyset == nil {\n\t\t\treturn fmt.Errorf(\"keyset %q not found\", name)\n\t\t}\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L217-L253","documentation":"In the keypair task's Render, after storing a new certificate the code re-reads the keyset from the keystore to make sure it round-trips. If FindKeyset returns nil (not found) the task returns this error, meaning the certificate that was just created cannot be read back from the keystore.","triggerScenarios":"Render creates a certificate for a keypair, stores it, then the immediate verification call c.T.Keystore.FindKeyset(ctx, name) returns nil — i.e. the write did not persist or is invisible to subsequent reads.","commonSituations":"Broken or misconfigured keystore backends (e.g. a VFS/CSI keystore that silently drops writes), racing processes writing the same keyset, or a custom keystore implementation whose FindKeyset does not see freshly stored keysets.","solutions":["Inspect the keystore backend for the cluster and confirm the write path actually persists keysets (check permissions, bucket/object store health).","Re-run kops with a different --target or phase to force re-render and see if the keystore write succeeds.","Check for concurrent kops runs against the same cluster that could overwrite or hide the newly stored keyset.","If using a custom keystore, verify FindKeyset returns stored keysets immediately after StoreKeyset."],"exampleFix":"// before (custom keystore may not see uncommitted writes)\nroundtrip, err := c.T.Keystore.FindKeyset(ctx, name)\n// after: ensure StoreKeyset is committed before re-reading, or add retry\nroundtrip, err := c.T.Keystore.FindKeyset(ctx, name)\nif roundtrip == nil {\n    time.Sleep(100 * time.Millisecond)\n    roundtrip, err = c.T.Keystore.FindKeyset(ctx, name)\n}","handlingStrategy":"validation","validationCode":"ks, err := keystore.FindKeyset(ctx, name)\nif err != nil { return err }\nif ks == nil { return fmt.Errorf(\"keyset %q missing before render\", name) }","typeGuard":"if keyset == nil { return fmt.Errorf(\"keyset %q not found\", name) }","tryCatchPattern":"if err != nil { return fmt.Errorf(\"verifying created certificate %q: %w\", name, err) }","preventionTips":["Do not run concurrent kops updates against the same cluster","Back up the state-store pki directory before applying changes","Verify keystore backend persistence after StoreKeyset in custom implementations"],"tags":["keystore","certificate","pki"],"backgroundTag":"keystore-keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}