kubernetes/kops · error

error fetching CA keypair: %v

Error message

error fetching CA keypair: %v

What it means

Looking up the 'ca' keyset in the cluster's keystore failed while adding the CA certificate to kubeconfig; a state-store read error (permissions, missing pki path) rather than simple absence — absence is reported by the sibling 'cannot find CA certificate' error.

Source

Thrown at pkg/kubeconfig/create_kubecfg.go:157

	}

	b := NewKubeconfigBuilder()

	// Use the secondary load balancer port if a certificate is on the primary listener
	if options.Admin != 0 && cluster.Spec.API.LoadBalancer != nil && cluster.Spec.API.LoadBalancer.SSLCertificate != "" && cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork {
		server = server + ":8443"
	}

	b.Context = clusterName
	b.Server = server
	b.TLSServerName = cluster.APIInternalName()

	// add the CA Cert to the kubeconfig only if we didn't specify a certificate for the LB
	//  or if we're using admin credentials and the secondary port
	if cluster.Spec.API.LoadBalancer == nil || cluster.Spec.API.LoadBalancer.SSLCertificate == "" || cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork || options.Internal {
		keySet, err := keyStore.FindKeyset(ctx, fi.CertificateIDCA)
		if err != nil {
			return nil, fmt.Errorf("error fetching CA keypair: %v", err)
		}
		if keySet != nil {
			b.CACerts, err = keySet.ToCertificateBytes()
			if err != nil {
				return nil, err
			}
		} else {
			return nil, fmt.Errorf("cannot find CA certificate")
		}
	}

	if options.Admin != 0 {
		cn := "kubecfg"
		user, err := user.Current()
		if err != nil || user == nil {
			klog.Infof("unable to get user: %v", err)
		} else {
			cn += "-" + user.Name

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the pki/ca keyset exists in the state store
2. Check state-store read permissions
3. Retry after resolving state-store access

When it happens

Trigger: Thrown at pkg/kubeconfig/create_kubecfg.go:157 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/912f28ec34090c6c. Report an issue: GitHub.