cannot use current data for %s; field is not settable

Error message

cannot use current data for %s; field is not settable

What it means

When k3s rotates certificates or bootstraps with user-supplied certs, it walks the Control.Runtime cert/key fields with reflection. For each field whose new file is missing, empty, or not marked rotate:"true", it tries to carry over the existing value from the old struct (oldVal -> newVal). The copy requires the reflected field to be settable; if newVal was obtained through a non-addressable value or an unexported field, CanSet() is false and this error is recorded.

Source

Thrown at pkg/server/handlers/cert.go:124

	oldMeta := reflect.ValueOf(&oldControl.Runtime.ControlRuntimeBootstrap).Elem()
	newMeta := reflect.ValueOf(&newControl.Runtime.ControlRuntimeBootstrap).Elem()

	// use the existing file if the new file does not exist or is empty
	for _, field := range reflect.VisibleFields(oldMeta.Type()) {
		newVal := newMeta.FieldByName(field.Name)
		info, err := os.Stat(newVal.String())
		if err != nil && !errors.Is(err, fs.ErrNotExist) {
			errs = append(errs, errors.WithMessage(err, field.Name))
			continue
		}

		if field.Tag.Get("rotate") != "true" || info == nil || info.Size() == 0 {
			if newVal.CanSet() {
				oldVal := oldMeta.FieldByName(field.Name)
				logrus.Infof("Using current data for %s: %s", field.Name, oldVal)
				newVal.Set(oldVal)
			} else {
				errs = append(errs, fmt.Errorf("cannot use current data for %s; field is not settable", field.Name))
			}
		}
	}
	return errors.Join(errs...)
}

// validateBootstrap checks the new certs and keys to ensure that the cluster would function properly were they to be used.
// - The new leaf CA certificates must be verifiable using the same root and intermediate certs as the current leaf CA certificates.
// - The new service account signing key bundle must include the currently active signing key.
func validateBootstrap(oldControl, newControl *config.Control) error {
	errs := []error{}

	// Use reflection to iterate over all of the bootstrap fields, checking files at each of the new paths.
	oldMeta := reflect.ValueOf(&oldControl.Runtime.ControlRuntimeBootstrap).Elem()
	newMeta := reflect.ValueOf(&newControl.Runtime.ControlRuntimeBootstrap).Elem()

	for _, field := range reflect.VisibleFields(oldMeta.Type()) {
		// Only handle bootstrap fields tagged for rotation

View on GitHub (pinned to 6ba341e396)

Solutions

Provide the complete set of custom certificate and key files referenced by your configuration, so no field needs its value carried over from the old struct.
If you intended full rotation, ensure every file meant to be regenerated is absent and fields are tagged rotate:true, then rerun k3s certificate rotate.
Check file sizes of everything under your cert directory; zero-byte files push fields onto the carry-over path.
If all files are complete and the error persists on the current release, report it upstream with your k3s version - the un-settable field is a code defect, not a config problem.

Example fix

# before: partial bundle, some files missing
sudo ls /etc/rancher/k3s/certs  # client-k3s-controller.crt absent -> carry-over path

# after: complete bundle or none
sudo k3s certificate rotate  # let k3s regenerate everything instead of mixing

Defensive patterns

Strategy: validation

Validate before calling

// Before rotating, confirm every referenced cert/key file exists and is non-empty
for _, f := range certFiles {
    fi, err := os.Stat(f)
    if err != nil || fi.Size() == 0 {
        log.Fatalf("missing or empty: %s", f)
    }
}

Try / catch

// Wrap the rotate call and surface the joined errors individually
if err := validateBootstrap(oldControl, newControl); err != nil {
    for _, e := range errors.Unwrap(err).([]error) { // errors.Join payload
        if strings.Contains(e.Error(), "field is not settable") {
            // config problem: supply complete cert set or report upstream
        }
    }
}

Prevention

Supply complete custom cert bundles or none - never partial sets
Keep rotate:true tagging consistent with fields you expect k3s to regenerate
Test rotation on a staging cluster before production

When it happens

Trigger: Invoking certificate rotation (k3s certificate rotate) or passing a partial set of custom cert/key files in the cluster configuration while some Control.Runtime fields are not settable through reflection - e.g. the struct value was copied rather than addressed, or a field is unexported. The error is aggregated by errors.Join and returned from the rotation prep step.

Common situations: Operators supplying an incomplete custom certificate bundle (some files present, others absent/zero-byte) so the carry-over path is taken; or a k3s version change that altered Control.Runtime field composition so reflection hits a field it cannot set. Usually appears immediately when starting the rotate handler.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/266fe1eddd6d598e. Report an issue: GitHub.