kubernetes/kops · error

certificate %q not found

Error message

certificate %q not found

What it means

The keyset item for the requested keypair ID exists but has no Certificate part, so buildCertificatePairTask cannot serialize the .crt file. This indicates an incomplete/corrupt keypair entry in the keystore.

Source

Thrown at nodeup/pkg/model/context.go:408

	}

	keyset, err := c.KeyStore.FindKeyset(ctx.Context(), name)
	if err != nil {
		return err
	}
	if keyset == nil {
		return fmt.Errorf("keyset %q not found", name)
	}

	item := keyset.Items[keypairID]
	if item == nil {
		return fmt.Errorf("did not find keypair %s for %s", keypairID, name)
	}

	if includeCert {
		certificate := item.Certificate
		if certificate == nil {
			return fmt.Errorf("certificate %q not found", name)
		}

		cert, err := certificate.AsString()
		if err != nil {
			return err
		}

		ctx.AddTask(&nodetasks.File{
			Path:           p + ".crt",
			Contents:       fi.NewStringResource(cert),
			Type:           nodetasks.FileType_File,
			Mode:           s("0600"),
			Owner:          owner,
			BeforeServices: beforeServices,
		})
	}

	privateKey := item.PrivateKey

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the keyset item: `kops get keypairs <name> -o yaml` to confirm the certificate field is empty
2. Re-issue the keypair: `kops create keypair <name>` to regenerate a full cert+key item and update nodes
3. Restore the complete keypair from a state-store backup
4. If a custom tool wrote the keyset, ensure it stores both Certificate and PrivateKey in the item

item := keyset.Items[keypairID]
if item == nil || item.Certificate == nil {
    return fmt.Errorf("keypair %s/%s incomplete (no certificate); run 'kops create keypair %s'", name, keypairID, name)
}

if err := c.BuildCertificatePairTask(ctx, name, path, filename, owner, nil); err != nil {
    if strings.Contains(err.Error(), "certificate") && strings.Contains(err.Error(), "not found") {
        // re-issue the keypair and retry
    }
    return err
}

When it happens

Trigger: item.Certificate is nil for the requested keypair in BuildCertificatePairTask/Build — e.g. the keyset stores only a private key (created via BuildPrivateKeyTask-style flows or manual state-store edits), or the certificate portion failed to persist.

Common situations: Manually patched state store objects; keystore backends where a write of cert succeeded but key failed (or vice versa) leaving a partial item; importing keypairs without a certificate.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• keyset %q not found
• private key %q not found
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w
• unsupported cloud provider for authenticator %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/14b1359840209c70. Report an issue: GitHub.