kubernetes/kops · error

unable to issue certificate: %v

Error message

unable to issue certificate: %v

What it means

buildCredentials asks pki.IssueCert to sign a new client certificate (CN kubecfg-<user>, in the system:masters group) using the cluster CA from the key store. If signing fails — missing CA key, decrypt errors, or key-store read failures — the error is wrapped as 'unable to issue certificate'. Without a fresh cert the helper cannot produce the ExecCredential kubectl needs.

Source

Thrown at pkg/commands/helpers/kubectl_auth.go:268

	if err != nil || user == nil {
		klog.Infof("unable to get user: %v", err)
	} else {
		cn += "-" + user.Name
	}

	req := pki.IssueCertRequest{
		Signer: fi.CertificateIDCA,
		Type:   "client",
		Subject: pkix.Name{
			CommonName: cn,

			Organization: []string{rbac.SystemPrivilegedGroup},
		},
		Validity: options.Lifetime,
	}
	cert, privateKey, _, err := pki.IssueCert(ctx, &req, fi.NewPKIKeystoreAdapter(keyStore))
	if err != nil {
		return nil, fmt.Errorf("unable to issue certificate: %v", err)
	}

	status := &ExecCredentialStatus{}
	status.ClientCertificateData, err = cert.AsString()
	if err != nil {
		return nil, err
	}
	status.ClientKeyData, err = privateKey.AsString()
	if err != nil {
		return nil, err
	}

	// Subtract a few minutes from the validity for clock skew
	status.ExpirationTimestamp = cert.Certificate.NotAfter.Add(-5 * time.Minute)

	return status, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm access to the cluster CA secret: try `kops get secrets kops-ca --cluster <name>` and fix IAM/KMS permissions if it fails.
2. If the CA key is KMS/vault-encrypted, ensure the runtime can decrypt it (correct AWS_KMS / vault credentials).
3. Restore or re-create the kops-ca key pair if it is missing, then re-run; as a last resort re-issue cluster certs via `kops toolbox pki` or cluster re-export.

Example fix

// before
$ kops helpers kubectl-auth --cluster c  # KMS decrypt denied
// after
$ aws kms grant ... / attach a policy allowing kms:Decrypt for the CA key
$ kops helpers kubectl-auth --cluster c

// verify CA secret access before invoking the helper
if err := exec.Command("kops", "get", "secrets", "kops-ca", "--cluster", clusterName).Run(); err != nil {
    return fmt.Errorf("cannot access cluster CA keystore: %v", err)
}

err := helpers.RunKubectlAuthHelper(ctx, f, out, options)
if err != nil && strings.Contains(err.Error(), "unable to issue certificate") {
    if isTransientKmsOrVaultError(err) {
        time.Sleep(2 * time.Second)
        err = helpers.RunKubectlAuthHelper(ctx, f, out, options)
    }
}

When it happens

Trigger: pki.IssueCert fails because the cluster CA key cannot be read/decrypted from the key store: CA key encrypted with an unavailable KMS key, keycloak/vault backend down, missing permissions on kops-ca secret, or CA key absent from the state store.

Common situations: Clusters using KMS/vault-encrypted CA keys where the operator lacks decrypt permissions; kubectl-auth run from a machine/container without state-store secret access; rotated or lost kops-ca key material; clock skew affecting validity windows.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• unable to find created certificate %q: %w
• unknown CA %q
• reading %q certificate: %v
• error issuing certificate: %v
• certificate %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/035b89a04dfe2b2f. Report an issue: GitHub.