kubernetes/kops · error

cannot find CA certificate

Error message

cannot find CA certificate

What it means

The CA keyset lookup succeeded but contained no usable CA certificate item; the keystore has a 'ca' keyset without a certificate, so the generated kubeconfig cannot embed a trusted CA bundle.

Source

Thrown at pkg/kubeconfig/create_kubecfg.go:165

	b.Context = clusterName
	b.Server = server
	b.TLSServerName = cluster.APIInternalName()

	// add the CA Cert to the kubeconfig only if we didn't specify a certificate for the LB
	//  or if we're using admin credentials and the secondary port
	if cluster.Spec.API.LoadBalancer == nil || cluster.Spec.API.LoadBalancer.SSLCertificate == "" || cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork || options.Internal {
		keySet, err := keyStore.FindKeyset(ctx, fi.CertificateIDCA)
		if err != nil {
			return nil, fmt.Errorf("error fetching CA keypair: %v", err)
		}
		if keySet != nil {
			b.CACerts, err = keySet.ToCertificateBytes()
			if err != nil {
				return nil, err
			}
		} else {
			return nil, fmt.Errorf("cannot find CA certificate")
		}
	}

	if options.Admin != 0 {
		cn := "kubecfg"
		user, err := user.Current()
		if err != nil || user == nil {
			klog.Infof("unable to get user: %v", err)
		} else {
			cn += "-" + user.Name
		}

		req := pki.IssueCertRequest{
			Signer: fi.CertificateIDCA,
			Type:   "client",
			Subject: pkix.Name{
				CommonName:   cn,
				Organization: []string{rbac.SystemPrivilegedGroup},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the ca keyset in the state store and regenerate the cluster CA if the certificate item is missing
2. Re-create the keyset via kops update or key-rotation tooling
3. Confirm the cluster was fully created before exporting kubeconfig

When it happens

Trigger: Thrown at pkg/kubeconfig/create_kubecfg.go:165 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e69e2ed59cbf1114. Report an issue: GitHub.