kubernetes/kops · error

keypair/service-account task not found

Error message

keypair/service-account task not found

What it means

During cluster model building, IssuerDiscoveryModelBuilder.Build publishes OIDC issuer discovery files, but the JWKS content depends on the service-account signing key task ('Keypair/service-account'). If that task was not registered in the model builder context, kops cannot reference the signing key and aborts with this error. It indicates an internal model-builder ordering/registration problem rather than user configuration alone.

Source

Thrown at pkg/model/issuerdiscovery.go:66

	JWKSURI               string   `json:"jwks_uri"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	ResponseTypes         []string `json:"response_types_supported"`
	SubjectTypes          []string `json:"subject_types_supported"`
	SigningAlgs           []string `json:"id_token_signing_alg_values_supported"`
	ClaimsSupported       []string `json:"claims_supported"`
}

func (b *IssuerDiscoveryModelBuilder) Build(c *fi.CloudupModelBuilderContext) error {
	ctx := context.TODO()

	serviceAccountIssuerDiscovery := b.Cluster.Spec.ServiceAccountIssuerDiscovery
	if serviceAccountIssuerDiscovery == nil || serviceAccountIssuerDiscovery.DiscoveryStore == "" {
		return nil
	}

	signingKeyTaskObject, found := c.Tasks["Keypair/service-account"]
	if !found {
		return fmt.Errorf("keypair/service-account task not found")
	}

	skTask := signingKeyTaskObject.(*fitasks.Keypair)

	keys := &OIDCKeys{
		SigningKey: skTask,
	}

	discovery, err := buildDiscoveryJSON(*b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer)
	if err != nil {
		return err
	}

	var publicFileACL *bool

	discoveryStorePath := b.Cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore
	discoveryStore, err := vfs.Context.BuildVfsPath(discoveryStorePath)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the cluster spec enables the service-account keypair (do not set kubeAPIServer.serviceAccountKey or related overrides that suppress the default keypair generation).
2. Run a full `kops update cluster` (not a narrowed builder phase) so the keypair model builder registers the task before IssuerDiscoveryModelBuilder.
3. Upgrade or rebuild kops from a released version; this is an internal task-registration bug if reproducible on stock kops.
4. File a kops issue with the full cluster spec and `--v=10` logs if the error persists on unmodified kops.

Example fix

// before (custom builder skipping keypair task)
c.AddTask(&fitasks.Keypair{Name: fi.ValueOf("apiserver")})
// after
c.AddTask(&fitasks.Keypair{Name: fi.ValueOf("apiserver")})
c.AddTask(&fitasks.Keypair{Name: fi.ValueOf("service-account")})

// Validate the cluster spec and environment before running kops update:
spec := cluster.Spec
if spec.ServiceAccountIssuerDiscovery != nil && spec.ServiceAccountIssuerDiscovery.DiscoveryStore != "" {
    if spec.KubeAPIServer == nil || spec.KubeAPIServer.ServiceAccountIssuer == nil || *spec.KubeAPIServer.ServiceAccountIssuer == "" {
        return fmt.Errorf("serviceAccountIssuerDiscovery requires kubeAPIServer.serviceAccountIssuer to be set")
    }
    // run a full `kops update cluster` so the Keypair/service-account task is registered
}

When it happens

Trigger: Running `kops update cluster` with cluster.spec.serviceAccountIssuerDiscovery.discoveryStore set, while the Keypair/service-account task is absent from the task map — typically because the keypair model builder did not run or was filtered out by lifecycle/phase selection.

Common situations: Custom kops builds with modified model builders, running a partial/targeted model build that skips the keypair builder, or a version/patch regression in kops where the service-account keypair task is no longer added before the issuer-discovery builder executes.

Related errors

• failed to load package: %w
• could not get name from ClusterPackage
• error listing oidc providers: %v
• error describing oidc provider: %v
• error creating IAMOIDCProvider: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/44ef6594ac2272f5. Report an issue: GitHub.