kubernetes/kops · error

error setting resources: %v

Error message

error setting resources: %v

What it means

After Find successfully loads a keypair's keyset from the keystore, kops calls setResources to serialize the keyset into certificate resources attached to the task. If serialization (keyset.ToCertificateBytes) fails, the error is wrapped as 'error setting resources'. This indicates the stored keyset data is malformed or cannot be encoded, not a missing entry.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:115

	}
	sort.Strings(alternateNames)

	actual := &Keypair{
		Name:           &name,
		AlternateNames: alternateNames,
		Subject:        pki.PkixNameToString(&cert.Subject),
		Issuer:         pki.PkixNameToString(&cert.Certificate.Issuer),
		Type:           pki.BuildTypeDescription(cert.Certificate),
		LegacyFormat:   keyset.LegacyFormat,
	}

	actual.Signer = &Keypair{Subject: pki.PkixNameToString(&cert.Certificate.Issuer)}

	// Avoid spurious changes
	actual.Lifecycle = e.Lifecycle

	if err := e.setResources(keyset); err != nil {
		return nil, fmt.Errorf("error setting resources: %v", err)
	}

	return actual, nil
}

func (e *Keypair) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (e *Keypair) Normalize(c *fi.CloudupContext) error {
	var alternateNames []string

	for _, s := range e.AlternateNames {
		s = strings.TrimSpace(s)
		if s == "" {
			continue
		}
		alternateNames = append(alternateNames, s)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Restore the keyset files for <name> from backup in the state store
2. Rotate the keypair: delete it via `kops delete secret keypair <name>` and re-run `kops update cluster --yes`
3. Inspect the stored keyset (cert/key PEM) for truncation or invalid base64/PEM
4. Upgrade/align kOps versions between the writer and reader of the state store

Example fix

// before: truncated PEM in state store for keyset 'apiserver'
// after
kops delete secret keypair apiserver --name mycluster.example.com
kops update cluster --yes

if _, err := keyset.ToCertificateBytes(); err != nil { return fmt.Errorf("keyset %q fails serialization: %v", name, err) }

if err != nil { if strings.Contains(err.Error(), "setting resources") { // rotate the affected keypair via kops delete secret keypair } return err }

When it happens

Trigger: Find on an existing keypair where keyset.ToCertificateBytes() returns an error — corrupted/invalid PEM data in the stored keyset, or an unsupported/legacy keyset layout that fails to serialize.

Common situations: State store contents manually edited or truncated; keyset written by an older kOps version with a legacy format that no longer parses; corruption during S3/GCS sync or partial upload.

Related errors

• unknown CA %q
• unable to issue certificate: %v
• ca key for %q was not found; cannot issue certificates
• ca certificate for %q was not found; cannot issue certificat
• error writing SSL private key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/049288e220a675d2. Report an issue: GitHub.