{"record":{"id":"e69e2ed59cbf1114","repo":"kubernetes/kops","slug":"cannot-find-ca-certificate","errorCode":null,"errorMessage":"cannot find CA certificate","messagePattern":"cannot find CA certificate","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kubeconfig/create_kubecfg.go","lineNumber":165,"sourceCode":"\n\tb.Context = clusterName\n\tb.Server = server\n\tb.TLSServerName = cluster.APIInternalName()\n\n\t// add the CA Cert to the kubeconfig only if we didn't specify a certificate for the LB\n\t//  or if we're using admin credentials and the secondary port\n\tif cluster.Spec.API.LoadBalancer == nil || cluster.Spec.API.LoadBalancer.SSLCertificate == \"\" || cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork || options.Internal {\n\t\tkeySet, err := keyStore.FindKeyset(ctx, fi.CertificateIDCA)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error fetching CA keypair: %v\", err)\n\t\t}\n\t\tif keySet != nil {\n\t\t\tb.CACerts, err = keySet.ToCertificateBytes()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"cannot find CA certificate\")\n\t\t}\n\t}\n\n\tif options.Admin != 0 {\n\t\tcn := \"kubecfg\"\n\t\tuser, err := user.Current()\n\t\tif err != nil || user == nil {\n\t\t\tklog.Infof(\"unable to get user: %v\", err)\n\t\t} else {\n\t\t\tcn += \"-\" + user.Name\n\t\t}\n\n\t\treq := pki.IssueCertRequest{\n\t\t\tSigner: fi.CertificateIDCA,\n\t\t\tType:   \"client\",\n\t\t\tSubject: pkix.Name{\n\t\t\t\tCommonName:   cn,\n\t\t\t\tOrganization: []string{rbac.SystemPrivilegedGroup},","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/kubeconfig/create_kubecfg.go#L147-L183","documentation":"The CA keyset lookup succeeded but contained no usable CA certificate item; the keystore has a 'ca' keyset without a certificate, so the generated kubeconfig cannot embed a trusted CA bundle.","triggerScenarios":"Thrown at pkg/kubeconfig/create_kubecfg.go:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the ca keyset in the state store and regenerate the cluster CA if the certificate item is missing","Re-create the keyset via kops update or key-rotation tooling","Confirm the cluster was fully created before exporting kubeconfig"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}