kubernetes/kops · error

error creating certificate: %w

Error message

error creating certificate: %w

What it means

getClientCertificate wraps a failure from the keystore-backed certificate creation (BuildTaskCertificate-style issuance signed by the cluster CA, fi.CertificateIDCA). It means the node challenge client could not obtain its client TLS certificate, typically because the keystore is unreachable or the CA is missing/misconfigured.

Source

Thrown at pkg/bootstrap/challenge_client.go:55

}

func NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error) {
	return &ChallengeClient{
		keystore: keystore,
	}, nil
}

func (c *ChallengeClient) getClientCertificate(ctx context.Context, clusterName string) (*tls.Certificate, error) {
	subject := challengeKopsControllerSubject(clusterName)

	certificate, privateKey, _, err := pki.IssueCert(ctx, &pki.IssueCertRequest{
		Validity: 1 * time.Hour,
		Signer:   fi.CertificateIDCA,
		Type:     "client",
		Subject:  subject,
	}, c.keystore)
	if err != nil {
		return nil, fmt.Errorf("error creating certificate: %w", err)
	}

	// TODO: Caching and rotation
	clientCertificate := &tls.Certificate{
		PrivateKey:  privateKey.Key,
		Certificate: [][]byte{certificate.Certificate.Raw},
		Leaf:        certificate.Certificate,
	}
	return clientCertificate, nil
}

func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error {
	challenge := bootstrapRequest.Challenge

	if challenge == nil {
		return fmt.Errorf("challenge not set")
	}
	if challenge.ChallengeID == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error (%w) to see whether it's a keystore access error or CA lookup failure
2. Verify the kops state store is reachable and credentials permit reading the cluster CA (kops get cluster --state <store>)
3. Ensure `kops update cluster`/createphase ran so the CA exists in the keystore
4. Confirm the cluster name used by the node matches the keystore path where the CA lives

// before starting bootstrap, confirm CA access
_, err := keystore.FindKeystoreCert(fi.CertificateIDCA)
if err != nil {
  return fmt.Errorf("cluster CA not readable from keystore: %w", err)
}

cert, err := getClientCertificate(ctx)
if err != nil {
  return fmt.Errorf("could not obtain client certificate: %w", err)
}

When it happens

Trigger: DoCallbackChallenge -> getClientCertificate issues a certificate with Signer: fi.CertificateIDCA from c.keystore; the keystore store (e.g. S3/state store) errors on read/write, or the CA key/certificate is absent or corrupt.

Common situations: State store (S3 bucket) credentials missing or bucket unreachable from the node; cluster CA not yet created; permissions on the keystore denying the read of the CA; cluster name mismatch pointing at the wrong state-store path.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to create certificate: %w
• certificate %q not found
• failed to parse certificate: %w
• unable to issue certificate: %v
• found cert in store, but did not find private key: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e8533722c65f1398. Report an issue: GitHub.