kubernetes/kops · error

found PKI volume, but HostPath was nil

Error message

found PKI volume, but HostPath was nil

What it means

After assembling the etcd-manager pod, kOps post-processes it and expects a hostPath volume named "pki" (used to expose /etc/kubernetes/pki to the etcd-manager container). If that volume exists but its HostPath field is nil (e.g. it was created as some other volume type), buildPod returns this error. It is a consistency check on the generated pod spec.

Source

Thrown at pkg/model/components/etcdmanager/model.go:651

		for _, envVar := range etcdCluster.Manager.Env {
			klog.V(2).Infof("overloading ENV var in manifest %s with %s=%s", bundle, envVar.Name, envVar.Value)
			configOverwrite := v1.EnvVar{
				Name:  envVar.Name,
				Value: envVar.Value,
			}

			container.Env = append(container.Env, configOverwrite)
		}
	}

	{
		foundPKI := false
		for i := range pod.Spec.Volumes {
			v := &pod.Spec.Volumes[i]
			if v.Name == "pki" {
				if v.HostPath == nil {
					return nil, fmt.Errorf("found PKI volume, but HostPath was nil")
				}
				dirname := "etcd-manager-" + etcdCluster.Name
				v.HostPath.Path = "/etc/kubernetes/pki/" + dirname
				foundPKI = true
			}
		}
		if !foundPKI {
			return nil, fmt.Errorf("did not find PKI volume")
		}
	}

	kubemanifest.MarkPodAsCritical(pod)
	kubemanifest.MarkPodAsClusterCritical(pod)

	return pod, nil
}

func linodeVolumeSelectors(clusterName, etcdClusterName, instanceGroupName string) ([]string, string) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Upgrade/downgrade kOps to a stable release where the pki volume is generated as a HostPath volume
2. Remove any hooks or patches that modify the etcd-manager pod volumes
3. Report the issue with kops version and the generated manifest (kops get --full) if it persists

// Defend around pod post-processing
pod, err := buildPod(ctx, b, etcdCluster)
if err != nil {
    if strings.Contains(err.Error(), "PKI volume") {
        klog.Warning("etcd-manager pki volume generation failed; likely kOps bug — check version")
    }
    return err
}

When it happens

Trigger: kops update cluster with pki volume generation producing a non-hostPath volume — typically caused by an internal model-build bug, a patch/hook mutating the pod manifest, or a corrupted template.

Common situations: Hit when using kOps builds with customized component templates, external manifest mutation tooling, or during kOps version regressions.

Related errors

• did not find PKI volume
• unknown CA %q
• reading %q certificate: %v
• error generating private key: %v
• error issuing certificate: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a7fc561fc3d1964f. Report an issue: GitHub.