kubernetes/kops · error

PublicKey not set, and cannot be determined from %T

Error message

PublicKey not set, and cannot be determined from %T

What it means

Fires in signNewCertificate when the certificate template has a nil PublicKey and the provided private key also exposes no public key, so the CSR cannot be signed — the input at fault is a PrivateKey whose key material cannot yield a public key.

Source

Thrown at pkg/pki/csr.go:53

	randomComponent, err := crypto_rand.Int(crypto_rand.Reader, randomLimit)
	if err != nil {
		klog.Fatalf("error generating random number: %v", err)
	}

	serial := big.NewInt(timestamp)
	serial.Lsh(serial, 32)
	serial.Or(serial, randomComponent)

	return serial
}

func signNewCertificate(privateKey *PrivateKey, template *x509.Certificate, signer *x509.Certificate, signerPrivateKey *PrivateKey) (*Certificate, error) {
	if template.PublicKey == nil {
		template.PublicKey = privateKey.Key.Public()
	}

	if template.PublicKey == nil {
		return nil, fmt.Errorf("PublicKey not set, and cannot be determined from %T", privateKey)
	}

	now := time.Now()
	if template.NotBefore.IsZero() {
		template.NotBefore = now.Add(time.Hour * -48)
	}

	if template.NotAfter.IsZero() {
		template.NotAfter = now.Add(time.Hour * 10 * 365 * 24)
	}

	if template.SerialNumber == nil {
		serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
		serialNumber, err := crypto_rand.Int(crypto_rand.Reader, serialNumberLimit)
		if err != nil {
			return nil, fmt.Errorf("error generating certificate serial number: %s", err)
		}
		template.SerialNumber = serialNumber

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass a PrivateKey with a valid RSA/ECDSA key so its public key can be derived
2. Set template.PublicKey explicitly before signing
3. Verify the private key was parsed successfully and is not zero-valued

When it happens

Trigger: Thrown at pkg/pki/csr.go:53 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/61c1c9984749da9f. Report an issue: GitHub.