kubernetes/kops · error

wrong signer: expected %q got %q

Error message

wrong signer: expected %q got %q

What it means

staticKeystore.FindPrimaryKeypair (pki.Keystore implementation used by issue_cert during nodeup) only holds one keyset, so any request for a different signer name is rejected with this mismatch message naming expected vs got. It protects against signing a certificate with the wrong authority.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/issue_cert.go:211

func (a asBytesResource) Open() (io.Reader, error) {
	data, err := a.AsBytes()
	if err != nil {
		return nil, err
	}
	return bytes.NewReader(data), nil
}

type staticKeystore struct {
	keyset      string
	certificate *pki.Certificate
	key         *pki.PrivateKey
}

// FindPrimaryKeypair implements pki.Keystore
func (s staticKeystore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {
	if name != s.keyset {
		return nil, nil, fmt.Errorf("wrong signer: expected %q got %q", s.keyset, name)
	}
	return s.certificate, s.key, nil
}

func newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {
	if signer == "" {
		return nil, nil
	}

	if keypairID == "" {
		return nil, fmt.Errorf("missing keypairID for signer %s", signer)
	}

	keyset, err := keystore.FindKeyset(ctx, signer)
	if err != nil {
		return nil, fmt.Errorf("reading keyset for %s: %v", signer, err)
	}
	if keyset == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Compare the 'got' name in the error with the keyset names in the cluster's keypairs
2. Correct the Signer field on the IssueCert task to match the actual keyset name
3. If the signer was renamed, migrate/update the stored keyset reference
4. Re-pull latest nodeup/cluster spec so signer names agree

Example fix

// before
Signer: fi.String("kubernetes-ca")
// after
Signer: fi.String("kubernetes-master-certificate-authority") // matches stored keyset

// validate signer name against stored keysets before issuing
keysets, _ := keystoreReader.ListKeysets(ctx)
if !slices.Contains(keysets, signerName) {
  return fmt.Errorf("unknown signer %q; have %v", signerName, keysets)
}

cert, key, err := keystore.FindPrimaryKeypair(ctx, name)
if err != nil && strings.HasPrefix(err.Error(), "wrong signer:") {
  return fmt.Errorf("task signer %q not in keystore: %w", name, err)
}

When it happens

Trigger: IssueCert task asks pki to sign with a signer name that differs from the one the static keystore was constructed with in newStaticKeystore.

Common situations: Signer name typo or renamed keyset (e.g. 'kubernetes-ca' vs 'kubernetes-master-certificate-authority') between cluster spec and stored keyset; task requesting the wrong signer after an upgrade.

Related errors

• failed to get keyset from %q
• key %q not found
• failed to read %q certificates: %w
• key %q did not have primary id set
• KeyStore not set

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cb3c33fffde1af4a. Report an issue: GitHub.