{"record":{"id":"136b510f20610a8d","repo":"kubernetes/kops","slug":"no-keypair-id-for-q-136b51","errorCode":null,"errorMessage":"no keypair ID for %q","messagePattern":"no keypair ID for %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/discovery_service.go","lineNumber":108,"sourceCode":"\t\tClientKey:         keyResource,\n\t\tClientCA:          caResource,\n\t\tRegisterName:      id.Name,\n\t\tRegisterNamespace: id.Namespace,\n\t\tJWKS:              jwks,\n\t}\n\tc.AddTask(registerTask)\n\n\treturn nil\n}\n\nfunc findJWKSForServiceAccount(ctx context.Context, keypairIDs map[string]string, keystore fi.KeystoreReader) ([]nodetasks.JSONWebKey, error) {\n\tvar jwks []nodetasks.JSONWebKey\n\n\tname := \"service-account\"\n\tkeypairID := keypairIDs[name]\n\tif keypairID == \"\" {\n\t\t// kOps bug where KeypairID was not populated for the node role.\n\t\treturn nil, fmt.Errorf(\"no keypair ID for %q\", name)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, name)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif keyset == nil {\n\t\treturn nil, fmt.Errorf(\"keyset %q not found\", name)\n\t}\n\n\tfor _, item := range keyset.Items {\n\t\tif item.DistrustTimestamp != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif item.Certificate == nil || item.Certificate.Subject.CommonName != \"service-account\" {\n\t\t\tcontinue\n\t\t}\n","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/discovery_service.go#L90-L126","documentation":"The node discovery service builder builds a JWKS from the 'service-account' keypair. It first looks up the keypair ID in NodeupConfig.KeypairIDs; older kOps versions had a bug leaving KeypairID unpopulated for the node role, so when the map entry is empty this error is returned and the discovery-service task fails.","triggerScenarios":"findJWKSForServiceAccount is called (from discovery_service Build) with keypairIDs[\"service-account\"] empty — i.e. the node's NodeupConfig was generated by a kOps version that did not populate KeypairID for the node role, or the service-account keypair was never created/registered.","commonSituations":"Upgrading an old cluster where node bootstrap config predates KeypairIDs population; cluster state missing the service-account key; running nodeup from a newer binary against stale nodeup config generated by a buggy older kOps.","solutions":["Re-run `kops update cluster --refresh-cluster-issue-certificates` / `kops update cluster` to regenerate nodeup config with populated KeypairIDs","Ensure a service-account key exists: `kops get keypairs service-account --type secrets` ; if missing, re-issue via `kops update cluster`","Run `kops upgrade cluster` and re-apply so the node role's KeypairID is populated","Regenerate the node's bootstrap config with a current kops binary"],"exampleFix":"# regenerate config so KeypairIDs are populated\nkops update cluster mycluster.example.com --yes --admin\nkops rolling-update cluster mycluster.example.com --yes","handlingStrategy":"validation","validationCode":"// before building the discovery service, ensure the keypair ID is populated\nkpID := nodeupConfig.KeypairIDs[\"service-account\"]\nif kpID == \"\" {\n\t// regenerate nodeup config: kops update cluster <cluster> --yes\n\treturn fmt.Errorf(\"service-account keypair ID missing in nodeup config; re-run kops update cluster\")\n}","typeGuard":null,"tryCatchPattern":"jwks, err := findJWKSForServiceAccount(ctx, keypairIDs, keystore)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no keypair ID\") {\n\t\t// known kOps bug for old node roles: regenerate bootstrap config and retry\n\t\treturn fmt.Errorf(\"stale nodeup config (missing KeypairID); re-run kops update cluster: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Regenerate nodeup config with a current kops binary after upgrading clusters","Verify `kops get instancegroup` output includes the node role keypair IDs before rolling updates","Keep the service-account keypair present in cluster state; never hand-edit NodeupConfig","Run `kops update cluster` after any kOps version upgrade before restarting nodes"],"tags":["keypair","service-account","discovery-service","nodeup","config"],"backgroundTag":"missing-keypair-id","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}