kubernetes/kops · error

did not find PKI volume

Error message

did not find PKI volume

What it means

As a follow-up to the pki volume loop, buildPod requires that the etcd-manager pod contains a volume named "pki" and sets foundPKI when it remaps it. If no such volume was found after scanning all pod.Spec.Volumes, the build fails with "did not find PKI volume". This guards the PKI directory mounting that etcd-manager needs to read control-plane certificates.

Source

Thrown at pkg/model/components/etcdmanager/model.go:659

			container.Env = append(container.Env, configOverwrite)
		}
	}

	{
		foundPKI := false
		for i := range pod.Spec.Volumes {
			v := &pod.Spec.Volumes[i]
			if v.Name == "pki" {
				if v.HostPath == nil {
					return nil, fmt.Errorf("found PKI volume, but HostPath was nil")
				}
				dirname := "etcd-manager-" + etcdCluster.Name
				v.HostPath.Path = "/etc/kubernetes/pki/" + dirname
				foundPKI = true
			}
		}
		if !foundPKI {
			return nil, fmt.Errorf("did not find PKI volume")
		}
	}

	kubemanifest.MarkPodAsCritical(pod)
	kubemanifest.MarkPodAsClusterCritical(pod)

	return pod, nil
}

func linodeVolumeSelectors(clusterName, etcdClusterName, instanceGroupName string) ([]string, string) {
	volumeTags := []string{
		fmt.Sprintf("%s:%s", linode.TagKubernetesClusterName, linode.NormalizeLinodeLabel(clusterName)),
		fmt.Sprintf("%s:%s", linode.TagKubernetesVolumeRole, linode.NormalizeLinodeLabel(etcdClusterName)),
	}
	volumeNameTag := fmt.Sprintf("%s:%s", linode.TagKubernetesInstanceGroup, linode.NormalizeLinodeLabel(instanceGroupName))
	return volumeTags, volumeNameTag
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use an unmodified, current kOps release so the pki volume is added to the pod template
2. Revert local patches to pkg/model/components/etcdmanager that removed the pki volume
3. Check that no external manifest mutation strips volumes, then rerun kops update cluster

if err := buildManifest(); err != nil {
    if strings.Contains(err.Error(), "did not find PKI volume") {
        return fmt.Errorf("kops build missing pki volume in etcd-manager template: %w", err)
    }
    return err
}

When it happens

Trigger: kops update cluster where the etcd-manager pod template was built without the pki volume — kOps internal regression, or the volume was dropped/renamed by custom manifest processing.

Common situations: Seen during kOps version upgrades with model changes, or in forked kOps builds where the pod template was edited.

Related errors

• found PKI volume, but HostPath was nil
• unknown CA %q
• reading %q certificate: %v
• error generating private key: %v
• error issuing certificate: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ffada05ce0528ff1. Report an issue: GitHub.