kubernetes/kops · error

error building kubelet server cert

Error message

error building kubelet server cert: %v

What it means

KubeletBuilder.Build wraps failures from buildKubeletServingCertificate with this message. That helper provisions the kubelet server serving certificate/key tasks; any error generating, finding, or storing the cert in the nodeup context is reported here.

Solutions

1. Read the wrapped inner error for the root cause (missing cert vs key vs store access).
2. Re-run kops update/rolling-update to regenerate and redistribute kubelet server certificates.
3. Check that the node can access the keystore/SSL paths where the serving cert is stored.
4. Verify cluster PKI (CA) configuration in the cluster spec is intact.

err := runNodeup(ctx)
if err != nil {
    var pathErr *fs.PathError
    if errors.As(err, &pathErr) {
        // certificate/key path unreadable: fix keystore permissions and retry
    }
    return fmt.Errorf("nodeup kubelet cert stage failed: %w", err)
}

When it happens

Trigger: buildKubeletServingCertificate fails, e.g. missing kubelet server certificate in the keystore, missing private key, or failure creating the alternate-names/task for the serving cert.

Common situations: Node bootstrap where the kubelet server cert was never issued (PKI misconfig), keys not distributed to the node, or SSL/keystore path problems during nodeup model building.

Related errors

• decoding pem public key
• encoding kubelet component config
• error building kubelet config
• error building kubelet flags
• error disabling swap

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/af5e0e3240b438df. Report an issue: GitHub.

Appendix: source

Thrown at nodeup/pkg/model/kubelet.go:106

	info, ok := runtime.SerializerInfoForMediaType(codecFactory.SupportedMediaTypes(), "application/yaml")
	if !ok {
		panic(fmt.Sprintf("no YAML serializer registered for kubelet scheme %v", gv))
	}
	return codecFactory.EncoderForVersion(info.Serializer, gv)
}

// KubeletBuilder installs kubelet
type KubeletBuilder struct {
	*NodeupModelContext
}

var _ fi.NodeupModelBuilder = &KubeletBuilder{}

// Build is responsible for building the kubelet configuration
func (b *KubeletBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	err := b.buildKubeletServingCertificate(c)
	if err != nil {
		return fmt.Errorf("error building kubelet server cert: %v", err)
	}

	ctx := c.Context()
	kubeletConfig, err := b.buildKubeletConfigSpec(ctx)
	if err != nil {
		return fmt.Errorf("error building kubelet config: %v", err)
	}

	{
		// Set the provider ID to help speed node registration on large clusters
		var providerID string
		if b.CloudProvider() == kops.CloudProviderAWS {
			config, err := awsconfig.LoadDefaultConfig(ctx)
			if err != nil {
				return fmt.Errorf("error loading AWS config: %v", err)
			}
			metadata := imds.NewFromConfig(config)
			instanceIdentity, err := metadata.GetInstanceIdentityDocument(ctx, &imds.GetInstanceIdentityDocumentInput{})

View on GitHub (pinned to 4c8573c808)