kubernetes/kops · error

error reading user provided cert %q: %v

Error message

error reading user provided cert %q: %v

What it means

This error occurs when the certificate file passed with --cert to `kops create keypair` cannot be read from disk. os.ReadFile fails, typically because the path is wrong, unreadable, or missing. The path is expanded from ~ before reading.

Source

Thrown at cmd/kops/create_keypair.go:226

			}
		}

		serial := pki.BuildPKISerial(time.Now().UnixNano())
		req := pki.IssueCertRequest{
			Type:       "ca",
			Subject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},
			Serial:     serial,
			PrivateKey: privateKey,
		}
		cert, _, _, err = pki.IssueCert(ctx, &req, nil)
		if err != nil {
			return fmt.Errorf("error issuing certificate: %v", err)
		}
	} else {
		options.CertPath = utils.ExpandPath(options.CertPath)
		certBytes, err := os.ReadFile(options.CertPath)
		if err != nil {
			return fmt.Errorf("error reading user provided cert %q: %v", options.CertPath, err)
		}

		cert, err = pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return fmt.Errorf("error loading certificate %q: %v", options.CertPath, err)
		}
	}

	keyset, err := keyStore.FindKeyset(ctx, name)
	var item *fi.KeysetItem
	if os.IsNotExist(err) || (err == nil && keyset == nil) {
		if options.Primary {
			if keyset, err = fi.NewKeyset(cert, privateKey); err != nil {
				return err
			}
		} else {
			return fmt.Errorf("the first keypair added to a keyset must be primary")
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the file exists: ls -l <certPath>.
2. Use an absolute path or confirm ~ expansion resolves to the intended file.
3. Check read permissions for the user running kOps.
4. Re-copy/export the certificate if it is missing.

Example fix

// before
kops create keypair cluster.name kubernetes-ca --cert ./ca.crt
// error: open ./ca.crt: no such file or directory
// after
kops create keypair cluster.name kubernetes-ca --cert /etc/pki/ca.crt

fi, err := os.Stat(certPath)
if err != nil {
    return fmt.Errorf("cert file not accessible: %w", err)
}
if fi.IsDir() {
    return errors.New("cert path is a directory, not a file")
}

if err != nil && strings.Contains(err.Error(), "error reading user provided cert") {
    // surface the wrapped os error and the expanded path to the user
}

When it happens

Trigger: Running `kops create keypair <cluster> <keyset> --cert <path>` where <path> does not exist, has a typo, points to a directory, or the process lacks read permission.

Common situations: Relative path executed from the wrong working directory; file never copied to the host; wrong ~ expansion; read permissions blocked by secrets-management mounts.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• error reading file %q: %v
• error reading SSH key file %q: %v
• error reading SSH public key files %q: %v
• reading Cilium IPSec config %v: %v
• unable to open file: %s, error: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2788d2bd624cb808. Report an issue: GitHub.