What causes "error creating discovery CA: %w" in kubernetes/kops?

Ensure the state-store credentials allow writes

error creating discovery CA: %w

Error message

error creating discovery CA: %w

What it means

When no discovery CA exists, discoveryUniverseID creates one via fitasks.CreateKeyset with an IssueCertRequest of type "ca"; if issuance fails this wrapped error is returned. It means the CA generation/write to the keystore failed.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:1791

// discoveryUniverseID returns the universe ID for the cluster's discovery service,
// creating a new discovery CA if necessary.
func discoveryUniverseID(ctx context.Context, keystore fi.Keystore) (string, error) {
	keyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)
	if err != nil {
		return "", fmt.Errorf("error finding discovery CA: %w", err)
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {
		subject := pkix.Name{
			CommonName: fi.DiscoveryCAID,
		}
		keyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{
			Subject: subject,
			Type:    "ca",
		})
		if err != nil {
			return "", fmt.Errorf("error creating discovery CA: %w", err)
		}
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {
		return "", fmt.Errorf("discovery CA creation failed")
	}

	return discoveryapi.ComputeUniverseIDFromCertificate(keyset.Primary.Certificate.Certificate), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Ensure the state-store credentials allow writes
Retry — transient backend errors are often resolved on re-run (idempotent keyset creation)
Check for concurrent kops runs against the same cluster state and run one at a time

Defensive patterns

Strategy: retry

Validate before calling

// ensure credentials allow writes to the keystore path
if !canWrite(stateStore) {
    return errors.New("state store is read-only; cannot create discovery CA")
}

Try / catch

keyset, err := fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, req)
if err != nil {
    if isConflictOrThrottle(err) {
        // retry after backoff
    }
    return err
}

Prevention

Use writable credentials for create/upgrade
Avoid concurrent kops runs on the same cluster

When it happens

Trigger: First cluster creation where the discovery CA does not yet exist and CreateKeyset fails: keystore write permission denied, backend conflict/concurrent creation, crypto issuance failure.

Common situations: Read-only state store credentials during create; two kops processes racing to create the same CA; backend quota or throttling errors.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/93020a18cd1c26b5. Report an issue: GitHub.