kubernetes/kops · error

error building kubelet server cert: %v

Error message

error building kubelet server cert: %v

What it means

KubeletBuilder.Build wraps failures from buildKubeletServingCertificate with this message. That helper provisions the kubelet server serving certificate/key tasks; any error generating, finding, or storing the cert in the nodeup context is reported here.

Source

Thrown at nodeup/pkg/model/kubelet.go:106

	info, ok := runtime.SerializerInfoForMediaType(codecFactory.SupportedMediaTypes(), "application/yaml")
	if !ok {
		panic(fmt.Sprintf("no YAML serializer registered for kubelet scheme %v", gv))
	}
	return codecFactory.EncoderForVersion(info.Serializer, gv)
}

// KubeletBuilder installs kubelet
type KubeletBuilder struct {
	*NodeupModelContext
}

var _ fi.NodeupModelBuilder = &KubeletBuilder{}

// Build is responsible for building the kubelet configuration
func (b *KubeletBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	err := b.buildKubeletServingCertificate(c)
	if err != nil {
		return fmt.Errorf("error building kubelet server cert: %v", err)
	}

	ctx := c.Context()
	kubeletConfig, err := b.buildKubeletConfigSpec(ctx)
	if err != nil {
		return fmt.Errorf("error building kubelet config: %v", err)
	}

	{
		// Set the provider ID to help speed node registration on large clusters
		var providerID string
		if b.CloudProvider() == kops.CloudProviderAWS {
			config, err := awsconfig.LoadDefaultConfig(ctx)
			if err != nil {
				return fmt.Errorf("error loading AWS config: %v", err)
			}
			metadata := imds.NewFromConfig(config)
			instanceIdentity, err := metadata.GetInstanceIdentityDocument(ctx, &imds.GetInstanceIdentityDocumentInput{})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error for the root cause (missing cert vs key vs store access).
2. Re-run kops update/rolling-update to regenerate and redistribute kubelet server certificates.
3. Check that the node can access the keystore/SSL paths where the serving cert is stored.
4. Verify cluster PKI (CA) configuration in the cluster spec is intact.

err := runNodeup(ctx)
if err != nil {
    var pathErr *fs.PathError
    if errors.As(err, &pathErr) {
        // certificate/key path unreadable: fix keystore permissions and retry
    }
    return fmt.Errorf("nodeup kubelet cert stage failed: %w", err)
}

When it happens

Trigger: buildKubeletServingCertificate fails, e.g. missing kubelet server certificate in the keystore, missing private key, or failure creating the alternate-names/task for the serving cert.

Common situations: Node bootstrap where the kubelet server cert was never issued (PKI misconfig), keys not distributed to the node, or SSL/keystore path problems during nodeup model building.

Related errors

• decoding pem public key
• parsing key: %v
• error reading certificate %q: %v
• error reading client keypair: %v
• no keypairID for %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/af5e0e3240b438df. Report an issue: GitHub.