failed to init kubernetes.io/kube-apiserver-client certifica

Error message

failed to init kubernetes.io/kube-apiserver-client certificate controller: %w

What it means

When the kube-apiserver-client signer files are configured, signer.NewKubeAPIServerClientCSRSigningController builds the signer that signs CSRs of type kubernetes.io/kube-apiserver-client. A returned error aborts construction of the CSR signing controller.

Source

Thrown at cmd/kube-controller-manager/app/certificates.go:104

	}

	if kubeletClientSignerCertFile, kubeletClientSignerKeyFile := getKubeletClientSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(kubeletClientSignerCertFile) > 0 || len(kubeletClientSignerKeyFile) > 0 {
		kubeletClientSigner, err := signer.NewKubeletClientCSRSigningController(ctx, c, csrInformer, kubeletClientSignerCertFile, kubeletClientSignerKeyFile, certTTL)
		if err != nil {
			return nil, fmt.Errorf("failed to init kubernetes.io/kube-apiserver-client-kubelet certificate controller: %w", err)
		}

		rx = append(rx, func(ctx context.Context) {
			kubeletClientSigner.Run(ctx, 5)
		})
	} else {
		logger.Info("Skipping CSR signer controller because specific files were specified for other signers and not this one", "controller", "kubernetes.io/kube-apiserver-client-kubelet")
	}

	if kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile := getKubeAPIServerClientSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(kubeAPIServerSignerCertFile) > 0 || len(kubeAPIServerSignerKeyFile) > 0 {
		kubeAPIServerClientSigner, err := signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, kubeAPIServerSignerCertFile, kubeAPIServerSignerKeyFile, certTTL)
		if err != nil {
			return nil, fmt.Errorf("failed to init kubernetes.io/kube-apiserver-client certificate controller: %w", err)
		}

		rx = append(rx, func(ctx context.Context) {
			kubeAPIServerClientSigner.Run(ctx, 5)
		})
	} else {
		logger.Info("Skipping CSR signer controller because specific files were specified for other signers and not this one", "controller", "kubernetes.io/kube-apiserver-client")
	}

	if legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile := getLegacyUnknownSignerFiles(controllerContext.ComponentConfig.CSRSigningController); len(legacyUnknownSignerCertFile) > 0 || len(legacyUnknownSignerKeyFile) > 0 {
		legacyUnknownSigner, err := signer.NewLegacyUnknownCSRSigningController(ctx, c, csrInformer, legacyUnknownSignerCertFile, legacyUnknownSignerKeyFile, certTTL)
		if err != nil {
			return nil, fmt.Errorf("failed to init kubernetes.io/legacy-unknown certificate controller: %w", err)
		}

		rx = append(rx, func(ctx context.Context) {
			legacyUnknownSigner.Run(ctx, 5)
		})

View on GitHub (pinned to b882c60b40)

Solutions

Verify the kube-apiserver-client signing cert and key files exist and are readable.
Confirm the cert/key pair matches (compare modulus).
Read the wrapped %w for the specific TLS error.
Regenerate the pair together and restart kube-controller-manager.

Defensive patterns

Strategy: validation

Validate before calling

# Pre-flight: validate the kube-apiserver-client signing pair.
CERT=/etc/kubernetes/pki/apiserver-client-ca.crt  # --cluster-signing-kube-apiserver-client-cert-file
KEY=/etc/kubernetes/pki/apiserver-client-ca.key   # --cluster-signing-kube-apiserver-client-key-file
openssl x509 -in "$CERT" -noout >/dev/null 2>&1 || { echo "bad cert" >&2; exit 1; }
openssl rsa  -in "$KEY"  -noout >/dev/null 2>&1 || { echo "bad key" >&2; exit 1; }
[ "$(openssl x509 -in "$CERT" -noout -modulus | openssl md5)" = "$(openssl rsa -in "$KEY" -noout -modulus | openssl md5)" ] \
  || { echo "cert/key mismatch" >&2; exit 1; }

Try / catch

signer, err := signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL)
if err != nil {
    return nil, fmt.Errorf("failed to init kubernetes.io/kube-apiserver-client certificate controller: %w", err)
}

Prevention

Deploy signing cert and key as an atomic pair.
Add a modulus-compare check to deploy scripts.
Keep file permissions correct for the controller-manager uid.

When it happens

Trigger: certificates.go:102 calls signer.NewKubeAPIServerClientCSRSigningController(ctx, c, csrInformer, certFile, keyFile, certTTL). It errors when the cert/key pair cannot be loaded/parsed, the pair does not match, or the files are unreadable.

Common situations: Misconfigured --cluster-signing-kube-apiserver-client-cert-file/--cluster-signing-kube-apiserver-client-key-file (or default pair) with missing/unreadable/mismatched files. PEM corruption, permission errors.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/5b83c6bf16439319. Report an issue: GitHub.