kubernetes/kops · error

kops-controller did not return a %q certificate

Error message

kops-controller did not return a %q certificate

What it means

Error "kops-controller did not return a %q certificate" thrown in kubernetes/kops.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go:136

		pkData, err := x509.MarshalPKIXPublicKey(key.Key.Public())
		if err != nil {
			return fmt.Errorf("marshalling public key: %v", err)
		}
		// TODO perhaps send a CSR instead to prove we own the private key?
		req.Certs[name] = string(pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: pkData}))
	}

	var resp nodeup.BootstrapResponse
	err := b.Client.Query(ctx, &req, &resp)
	if err != nil {
		return err
	}

	for name, certRequest := range b.Certs {
		cert, ok := resp.Certs[name]
		if !ok {
			return fmt.Errorf("kops-controller did not return a %q certificate", name)
		}
		certificate, err := pki.ParsePEMCertificate([]byte(cert))
		if err != nil {
			return fmt.Errorf("parsing %q certificate: %v", name, err)
		}
		certRequest.Cert.Resource = asBytesResource{certificate}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

When it happens

Trigger: Thrown at upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go:136 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/993b23b5771b70e4. Report an issue: GitHub.