{"record":{"id":"08f9e4346d0c8f63","repo":"kubernetes/kops","slug":"error-creating-keyset-q-v","errorCode":null,"errorMessage":"error creating keyset %q: %v","messagePattern":"error creating keyset %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":247,"sourceCode":"\n\toldKeyset, err := client.Get(ctx, name, metav1.GetOptions{})\n\tif errors.IsNotFound(err) {\n\t\toldKeyset = nil\n\t\terr = nil\n\t}\n\tif err == nil {\n\t\tif oldKeyset == nil {\n\t\t\tcreate = true\n\t\t} else {\n\t\t\tkopsKeyset.ObjectMeta = oldKeyset.ObjectMeta\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"error reading keyset %q: %v\", name, err)\n\t}\n\n\tif create {\n\t\tif _, err := client.Create(ctx, kopsKeyset, metav1.CreateOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"error creating keyset %q: %v\", name, err)\n\t\t}\n\t} else {\n\t\tif _, err := client.Update(ctx, kopsKeyset, metav1.UpdateOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"error updating keyset %q: %v\", name, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// addSSHCredential saves the specified SSH Credential to the registry, doing an update or insert\nfunc (c *ClientsetCAStore) addSSHCredential(ctx context.Context, publicKey string) error {\n\tcreate := false\n\tclient := c.clientset.SSHCredentials(c.namespace)\n\tsshCredential, err := client.Get(ctx, \"admin\", metav1.GetOptions{})\n\tif err != nil {\n\t\tif errors.IsNotFound(err) {\n\t\t\tsshCredential = nil\n\t\t} else {","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L229-L265","documentation":"When the Keyset does not already exist, storeKeyset calls client.Create; failure is wrapped as 'error creating keyset \"<name>\": <underlying>'. Most commonly this is AlreadyExists (a race with another writer) or an API/RBAC error, surfaced from upup/pkg/fi/clientset_castore.go:247 via StoreKeyset.","triggerScenarios":"client.Create fails: the keyset was created concurrently (AlreadyExists), RBAC denies create on keysets, the object is invalid per validation, or the API server rejects the request.","commonSituations":"Two kOps processes rotating keys at once; service accounts lacking create permission during automation; ObjectMeta/name conflicts after manual keyset creation.","solutions":["If the wrapped error is AlreadyExists, re-run the operation so storeKeyset takes the Update path, or fetch and merge into the existing keyset","Check RBAC allows creating keysets in the kops namespace","Serialize rotation operations (a single kOps run) to avoid create/update races","Inspect the underlying message for validation failures and fix the keyset payload"],"exampleFix":"// before: naive create fails on race\nclient.Create(ctx, kopsKeyset, metav1.CreateOptions{})\n// after: tolerate race by falling back to update\nif _, err := client.Create(ctx, kopsKeyset, metav1.CreateOptions{}); err != nil {\n\tif apierrors.IsAlreadyExists(err) {\n\t\t_, err = client.Update(ctx, kopsKeyset, metav1.UpdateOptions{})\n\t}\n\tif err != nil { return err }\n}","handlingStrategy":"retry","validationCode":"// detect likely race before create\nif _, err := kubeClient.Keysets(ns).Get(ctx, name, metav1.GetOptions{}); err == nil {\n\t// keyset exists; use the update path instead of expecting create\n}","typeGuard":"func isAlreadyExists(err error) bool {\n\treturn apierrors.IsAlreadyExists(errors.Unwrap(err)) || strings.Contains(err.Error(), \"AlreadyExists\")\n}","tryCatchPattern":"err := store.StoreKeyset(ctx, name, keyset)\nif err != nil {\n\tif strings.Contains(err.Error(), \"error creating keyset\") && strings.Contains(err.Error(), \"AlreadyExists\") {\n\t\t// re-run so storeKeyset takes the Update path\n\t}\n\treturn err\n}","preventionTips":["Run only one key-rotation process at a time to avoid create races","Check for AlreadyExists in the wrapped error and fall back to update","Grant create on keysets to automation identities"],"tags":["go","kubernetes","api-server","keyset","create"],"backgroundTag":"kubernetes-api-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}