kubernetes/kops · error

issuing certificate: %v

Error message

issuing certificate: %v

What it means

issueCert delegates actual certificate issuance to pki.IssueCert against the server's keystore. Any keystore/backend failure (unreadable CA, etcd/keys store unavailable, signing error) is wrapped as "issuing certificate: %v".

Source

Thrown at cmd/kops-controller/pkg/server/server.go:351

		}
	case "kube-router":
		issueReq.Subject = pkix.Name{
			CommonName: rbac.KubeRouter,
		}
	default:
		return "", fmt.Errorf("unexpected key name")
	}

	// This field was added to the protocol in kOps 1.22.
	if len(keypairIDs) > 0 {
		if keypairIDs[issueReq.Signer] != s.keypairIDs[issueReq.Signer] {
			return "", fmt.Errorf("request's keypair ID %q for %s didn't match server's %q", keypairIDs[issueReq.Signer], issueReq.Signer, s.keypairIDs[issueReq.Signer])
		}
	}

	cert, _, _, err := pki.IssueCert(ctx, issueReq, s.keystore)
	if err != nil {
		return "", fmt.Errorf("issuing certificate: %v", err)
	}

	return cert.AsString()
}

// recovery is responsible for ensuring we don't exit on a panic.
func recovery(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		defer func() {
			if err := recover(); err != nil {
				w.WriteHeader(http.StatusInternalServerError)

				klog.Errorf("failed to handle request: threw exception: %v: %s", err, debug.Stack())
			}
		}()

		next.ServeHTTP(w, req)
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check kops-controller logs for the underlying wrapped cause and verify keystore etcd connectivity from the controller
2. Verify the CA (e.g. "kubernetes-ca", "etcd-clients-ca") exists in the keystore; re-create via `kops update cluster` if missing
3. Restore keys backup or re-issue CAs if the keystore is corrupted, then re-bootstrap nodes
4. Restart kops-controller and retry node bootstrap once the backend is healthy

// check CA exists in keystore before issuing
_, err := keystore.FindKeypair(ctx, fi.CertificateIDCA)
if err != nil {
    return fmt.Errorf("CA keypair unavailable: %v", err)
}

cert, _, _, err := pki.IssueCert(ctx, issueReq, s.keystore)
if err != nil {
    log.Printf("IssueCert failed: %v", err) // inspect wrapped cause
    return "", fmt.Errorf("issuing certificate: %v", err)
}

When it happens

Trigger: pki.IssueCert returns an error: CA keypair missing or unreadable in the keystore, keystore backend (etcd cluster storing keys) unreachable, or invalid issue request for the backend.

Common situations: kops-controller cannot reach the keystore etcd cluster during node bootstrap; corrupted or missing CA in the key store; permission/backend issues after cluster restore or upgrade.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• decoding pem public key
• unexpected key type %q
• parsing key: %v
• key name not enabled
• unexpected key name

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6377a8814770d9d9. Report an issue: GitHub.