kubernetes/kops · error

error finding discovery CA: %w

Error message

error finding discovery CA: %w

What it means

discoveryUniverseID reads the cluster's discovery CA keyset (fi.DiscoveryCAID) from the keystore; if the keyset lookup call itself errors, this wrapped error is returned. It signals a keystore/backend failure while reading cluster discovery state, distinct from the CA simply not existing.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:1779

			case ec2types.ArchitectureTypeArm64:
				return architectures.ArchitectureArm64, nil
			default:
				unsupported = append(unsupported, arch)
			}
		}
		return "", fmt.Errorf("unsupported architecture for instance type %q: %v", machineType, unsupported)
	default:
		// No other clouds are known to support any other architectures at this time
		return architectures.ArchitectureAmd64, nil
	}
}

// discoveryUniverseID returns the universe ID for the cluster's discovery service,
// creating a new discovery CA if necessary.
func discoveryUniverseID(ctx context.Context, keystore fi.Keystore) (string, error) {
	keyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)
	if err != nil {
		return "", fmt.Errorf("error finding discovery CA: %w", err)
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil {
		subject := pkix.Name{
			CommonName: fi.DiscoveryCAID,
		}
		keyset, err = fitasks.CreateKeyset(ctx, keystore, fi.DiscoveryCAID, pki.IssueCertRequest{
			Subject: subject,
			Type:    "ca",
		})
		if err != nil {
			return "", fmt.Errorf("error creating discovery CA: %w", err)
		}
	}

	if keyset == nil || keyset.Primary == nil || keyset.Primary.Certificate == nil || keyset.Primary.Certificate.Certificate == nil {
		return "", fmt.Errorf("discovery CA creation failed")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify state-store access (credentials, bucket permissions, network)
2. Inspect the keystore object for the discovery CA in the state store and repair/restore if corrupted
3. Retry the operation if the backend error was transient

// pre-check state-store reachability/permissions
if err := checkStateStoreAccess(stateStore); err != nil {
    return err
}

keyset, err := keystore.FindKeyset(ctx, fi.DiscoveryCAID)
if err != nil {
    if isTransient(err) {
        // retry with backoff
    }
    return fmt.Errorf("keystore unavailable: %w", err)
}

When it happens

Trigger: Cluster creation/upgrade path that calls discoveryUniverseID when the keystore backend (e.g. S3/OSS/state store) returns an error on FindKeyset: backend unreachable, permission denied, corrupted state-store object.

Common situations: State store bucket permissions changed; network outage to the state store; partially deleted or corrupted cluster state.

Related errors

• unknown CA %q
• reading existing keyset: %v
• error storing user provided keys %q %q: %v
• error listing Keysets: %v
• listing keysets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/472873f0fe971c26. Report an issue: GitHub.