kubernetes/kops · error

error parsing Subject: %v

Error message

error parsing Subject: %v

What it means

When Render decides a new certificate must be created, it parses the task's Subject string (comma-separated k=v tokens) via parsePkixName, which only accepts keys 'cn' and 'o' and requires every token to be k=v. Any malformed subject produces 'error parsing Subject'. This is a strict local parser, not the full OpenSSL DN syntax.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:203

		} else if changes.Issuer != "" {
			createCertificate = true
			klog.V(8).Infof("creating certificate new Issuer")
		} else if changes.Type != "" {
			createCertificate = true
			klog.Infof("creating certificate %q as Type has changed (actual=%v, expected=%v)", name, a.Type, e.Type)
		} else if a.LegacyFormat {
			changeStoredFormat = true
		} else {
			klog.Warningf("Ignoring changes in key: %v", fi.DebugAsJsonString(changes))
		}
	}

	if createCertificate {
		klog.V(2).Infof("Creating PKI keypair %q", name)

		subjectPkix, err := parsePkixName(e.Subject)
		if err != nil {
			return fmt.Errorf("error parsing Subject: %v", err)
		}

		if len(subjectPkix.ToRDNSequence()) == 0 {
			return fmt.Errorf("subject name was empty for SSL keypair %q", *e.Name)
		}

		signer := fi.CertificateIDCA
		if e.Signer != nil {
			signer = fi.ValueOf(e.Signer.Name)
		}

		req := pki.IssueCertRequest{
			Signer:         signer,
			Type:           e.Type,
			Subject:        *subjectPkix,
			AlternateNames: e.AlternateNames,
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Rewrite the Subject using only CN= and O= tokens, e.g. 'CN=apiserver,O=kops'
2. Remove unsupported RDN fields (OU, L, ST, C are not accepted by this parser)
3. Ensure the subject is non-empty and each comma-separated token contains '='
4. Check the task/spec source (e.g. cluster spec field feeding e.Subject) for typos

Example fix

// before
Subject: "CN=ca,OU=Systems,L=SF"
// after
Subject: "CN=ca,O=Systems"

func validSubject(s string) bool { for _, tok := range strings.Split(s, ",") { kv := strings.SplitN(strings.TrimSpace(tok), "=", 2); if len(kv) != 2 { return false }; switch strings.ToLower(kv[0]) { case "cn", "o": default: return false } }; return s != "" }

if err != nil { if strings.Contains(err.Error(), "error parsing Subject") { // surface allowed keys (cn,o) to the operator } return err }

When it happens

Trigger: Render with createCertificate=true and e.Subject that parsePkixName rejects: tokens without '=' (e.g. 'example.com'), unknown keys (e.g. 'OU=foo', 'L=city', 'C=US'), or empty subject string.

Common situations: User sets cluster spec values (e.g. kubelet, master DNS keypair subjects) using full LDAP-style DNs with unsupported RDNs; subject accidentally left empty; whitespace/unquoted commas producing bare tokens.

Related errors

• subject name was empty for SSL keypair %q
• error issuing certificate: %v
• error converting public key to x509: %w
• error parsing certificate: %v
• error encoding ECDSA private key: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/077c8a62b2fa74ca. Report an issue: GitHub.