kubernetes/kops · error

control plane nodes can't get certs from kops-controller

Error message

control plane nodes can't get certs from kops-controller

What it means

Deliberate panic guard in NodeupModelContext.GetBootstrapCert: only worker nodes obtain keypairs from kops-controller, but IsMaster is true, meaning bootstrap-bundle logic was invoked on a control-plane node. Control-plane nodes receive their certificates through the CA/pki bundle instead, so reaching this call is a nodeup task-graph programming error, not a runtime condition.

Source

Thrown at nodeup/pkg/model/context.go:259

		Name: name,
		Cert: certResource,
		Key:  keyResource,
		CA:   caResource,
	}
	if c.HasAPIServer {
		// @note: use https even for local connections, so we can turn off the insecure port
		kubeConfig.ServerURL = "https://127.0.0.1"
	} else {
		kubeConfig.ServerURL = "https://" + c.APIInternalName()
	}
	ctx.AddTask(kubeConfig)
	return kubeConfig.GetConfig()
}

// GetBootstrapCert requests a certificate keypair from kops-controller.
func (c *NodeupModelContext) GetBootstrapCert(name string, signer string) (cert, key fi.Resource, err error) {
	if c.IsMaster {
		panic("control plane nodes can't get certs from kops-controller")
	}
	b, ok := c.bootstrapCerts[name]
	if !ok {
		b = &nodetasks.BootstrapCert{
			Cert: &fi.NodeupTaskDependentResource{},
			Key:  &fi.NodeupTaskDependentResource{},
		}
		c.bootstrapCerts[name] = b
	}
	c.bootstrapKeypairIDs[signer] = c.NodeupConfig.KeypairIDs[signer]
	if c.bootstrapKeypairIDs[signer] == "" {
		return nil, nil, fmt.Errorf("no keypairID for %q", signer)
	}
	return b.Cert, b.Key, nil
}

// BuildBootstrapKubeconfig generates a kubeconfig with a client certificate from either kops-controller or the state store.
func (c *NodeupModelContext) BuildBootstrapKubeconfig(name string, ctx *fi.NodeupModelBuilderContext) (fi.Resource, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Route control-plane nodes to the CA-based certificate tasks (nodeup/pki model) rather than GetBootstrapCert
2. Audit task builders (kubelet serving cert, cilium etcd secrets, bootstrap kubeconfig) for branch conditions that wrongly include masters

When it happens

Trigger: Thrown at nodeup/pkg/model/context.go:259 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9cdadc9f18a579c2. Report an issue: GitHub.