kubernetes/kops · error

discovery CA creation failed

Error message

discovery CA creation failed

What it means

After attempting to find or create the discovery CA, the code re-validates the keyset: if keyset, its Primary entry, the Certificate, or the embedded certificate object is still nil it returns this plain error. It is a post-condition guard indicating the keystore returned an incomplete CA keyset.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:1796

	if err != nil {
		return "", fmt.Errorf("error finding discovery CA: %w", err)
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {
		subject := pkix.Name{
			CommonName: fi.DiscoveryCAID,
		}
		keyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{
			Subject: subject,
			Type:    "ca",
		})
		if err != nil {
			return "", fmt.Errorf("error creating discovery CA: %w", err)
		}
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {
		return "", fmt.Errorf("discovery CA creation failed")
	}

	return discoveryapi.ComputeUniverseIDFromCertificate(keyset.Primary.Certificate.Certificate), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Delete the incomplete discovery CA keyset from the state store and re-run so it is recreated
2. Restore the keyset from backup
3. Verify state-store backend consistency (S3 versioning/etag issues) and upgrade kops

Example fix

// before (corrupted keyset left in place)
kops create cluster ...
// after (remove bad keyset, recreate)
kops toolbox dump / kops replace -f repaired-cluster.yaml ; kops create cluster ...

func keysetComplete(ks *fi.Keyset) bool {
    return ks != nil && ks.Primary != nil &&
        ks.Primary.Certificate != nil && ks.Primary.Certificate.Certificate != nil
}

id, err := discoveryUniverseID(ctx, keystore)
if err != nil {
    // repair: recreate the discovery CA keyset, then retry once
    return recreateDiscoveryCAAndRetry(ctx, keystore)
}

When it happens

Trigger: CreateKeyset or FindKeyset 'succeeded' but returned a structurally incomplete keyset — e.g. a partially written/corrupted keyset in the state store, or a backend bug returning empty primary data.

Common situations: Corrupted state-store keyset object after an interrupted write; incompatible state-store data from an older kops version; backend consistency issues.

Related errors

• unknown CA %q
• ca key for %q was not found; cannot issue certificates
• ca certificate for %q was not found; cannot issue certificat
• error creating discovery CA: %w
• unable to issue certificate: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e0945ea7b12c8fb5. Report an issue: GitHub.