diff --git a/cluster/reconcile.go b/cluster/reconcile.go
index 5773fdbc..cd1ccf21 100644
--- a/cluster/reconcile.go
+++ b/cluster/reconcile.go
@@ -25,6 +25,7 @@ const (
 )
 
 func ReconcileCluster(ctx context.Context, kubeCluster, currentCluster *Cluster, flags ExternalFlags, svcOptions *v3.KubernetesServicesOptions) error {
+	logrus.Debugf("[reconcile] currentCluster: %+v\n", currentCluster)
 	log.Infof(ctx, "[reconcile] Reconciling cluster state")
 	kubeCluster.UpdateWorkersOnly = flags.UpdateOnly
 	if currentCluster == nil {
@@ -32,6 +33,10 @@ func ReconcileCluster(ctx context.Context, kubeCluster, currentCluster *Cluster,
 		kubeCluster.UpdateWorkersOnly = false
 		return nil
 	}
+	// If certificates are not present, this is broken state and should error out
+	if len(currentCluster.Certificates) == 0 {
+		return fmt.Errorf("Certificates are not present in cluster state, recover rkestate file or certificate information in cluster state")
+	}
 
 	kubeClient, err := k8s.NewClient(kubeCluster.LocalKubeConfigPath, kubeCluster.K8sWrapTransport)
 	if err != nil {