{"record":{"id":"e0945ea7b12c8fb5","repo":"kubernetes/kops","slug":"discovery-ca-creation-failed","errorCode":null,"errorMessage":"discovery CA creation failed","messagePattern":"discovery CA creation failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":1796,"sourceCode":"\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error finding discovery CA: %w\", err)\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {\n\t\tsubject := pkix.Name{\n\t\t\tCommonName: fi.DiscoveryCAID,\n\t\t}\n\t\tkeyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{\n\t\t\tSubject: subject,\n\t\t\tType:    \"ca\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"error creating discovery CA: %w\", err)\n\t\t}\n\t}\n\n\tif keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {\n\t\treturn \"\", fmt.Errorf(\"discovery CA creation failed\")\n\t}\n\n\treturn discoveryapi.ComputeUniverseIDFromCertificate(keyset.Primary.Certificate.Certificate), nil\n}\n","sourceCodeStart":1778,"sourceCodeEnd":1801,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L1778-L1801","documentation":"After attempting to find or create the discovery CA, the code re-validates the keyset: if keyset, its Primary entry, the Certificate, or the embedded certificate object is still nil it returns this plain error. It is a post-condition guard indicating the keystore returned an incomplete CA keyset.","triggerScenarios":"CreateKeyset or FindKeyset 'succeeded' but returned a structurally incomplete keyset — e.g. a partially written/corrupted keyset in the state store, or a backend bug returning empty primary data.","commonSituations":"Corrupted state-store keyset object after an interrupted write; incompatible state-store data from an older kops version; backend consistency issues.","solutions":["Delete the incomplete discovery CA keyset from the state store and re-run so it is recreated","Restore the keyset from backup","Verify state-store backend consistency (S3 versioning/etag issues) and upgrade kops"],"exampleFix":"// before (corrupted keyset left in place)\nkops create cluster ...\n// after (remove bad keyset, recreate)\nkops toolbox dump / kops replace -f repaired-cluster.yaml ; kops create cluster ...","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func keysetComplete(ks *fi.Keyset) bool {\n    return ks != nil && ks.Primary != nil &&\n        ks.Primary.Certificate != nil && ks.Primary.Certificate.Certificate != nil\n}","tryCatchPattern":"id, err := discoveryUniverseID(ctx, keystore)\nif err != nil {\n    // repair: recreate the discovery CA keyset, then retry once\n    return recreateDiscoveryCAAndRetry(ctx, keystore)\n}","preventionTips":["Backup state-store keysets","Enable state-store versioning to recover partial writes","Validate cluster state after interrupted runs"],"tags":["pki","ca","keystore"],"backgroundTag":"incomplete-ca-keyset","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}