{"record":{"id":"ffada05ce0528ff1","repo":"kubernetes/kops","slug":"did-not-find-pki-volume","errorCode":null,"errorMessage":"did not find PKI volume","messagePattern":"did not find PKI volume","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/components/etcdmanager/model.go","lineNumber":659,"sourceCode":"\t\t\tcontainer.Env = append(container.Env, configOverwrite)\n\t\t}\n\t}\n\n\t{\n\t\tfoundPKI := false\n\t\tfor i := range pod.Spec.Volumes {\n\t\t\tv := &pod.Spec.Volumes[i]\n\t\t\tif v.Name == \"pki\" {\n\t\t\t\tif v.HostPath == nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"found PKI volume, but HostPath was nil\")\n\t\t\t\t}\n\t\t\t\tdirname := \"etcd-manager-\" + etcdCluster.Name\n\t\t\t\tv.HostPath.Path = \"/etc/kubernetes/pki/\" + dirname\n\t\t\t\tfoundPKI = true\n\t\t\t}\n\t\t}\n\t\tif !foundPKI {\n\t\t\treturn nil, fmt.Errorf(\"did not find PKI volume\")\n\t\t}\n\t}\n\n\tkubemanifest.MarkPodAsCritical(pod)\n\tkubemanifest.MarkPodAsClusterCritical(pod)\n\n\treturn pod, nil\n}\n\nfunc linodeVolumeSelectors(clusterName, etcdClusterName, instanceGroupName string) ([]string, string) {\n\tvolumeTags := []string{\n\t\tfmt.Sprintf(\"%s:%s\", linode.TagKubernetesClusterName, linode.NormalizeLinodeLabel(clusterName)),\n\t\tfmt.Sprintf(\"%s:%s\", linode.TagKubernetesVolumeRole, linode.NormalizeLinodeLabel(etcdClusterName)),\n\t}\n\tvolumeNameTag := fmt.Sprintf(\"%s:%s\", linode.TagKubernetesInstanceGroup, linode.NormalizeLinodeLabel(instanceGroupName))\n\treturn volumeTags, volumeNameTag\n}\n","sourceCodeStart":641,"sourceCodeEnd":677,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/components/etcdmanager/model.go#L641-L677","documentation":"As a follow-up to the pki volume loop, buildPod requires that the etcd-manager pod contains a volume named \"pki\" and sets foundPKI when it remaps it. If no such volume was found after scanning all pod.Spec.Volumes, the build fails with \"did not find PKI volume\". This guards the PKI directory mounting that etcd-manager needs to read control-plane certificates.","triggerScenarios":"kops update cluster where the etcd-manager pod template was built without the pki volume — kOps internal regression, or the volume was dropped/renamed by custom manifest processing.","commonSituations":"Seen during kOps version upgrades with model changes, or in forked kOps builds where the pod template was edited.","solutions":["Use an unmodified, current kOps release so the pki volume is added to the pod template","Revert local patches to pkg/model/components/etcdmanager that removed the pki volume","Check that no external manifest mutation strips volumes, then rerun kops update cluster"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := buildManifest(); err != nil {\n    if strings.Contains(err.Error(), \"did not find PKI volume\") {\n        return fmt.Errorf(\"kops build missing pki volume in etcd-manager template: %w\", err)\n    }\n    return err\n}","preventionTips":["Do not edit the etcd-manager pod template in forks","Pin kOps to official release binaries","Inspect generated manifests during upgrades to confirm the pki volume exists"],"tags":["etcd-manager","pki","pod-volumes"],"backgroundTag":"pki-volume-missing","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}