{"record":{"id":"30bd852f50c8d648","repo":"kubernetes/kops","slug":"findkeyset-q-not-supported-by-configserverkeystor","errorCode":null,"errorMessage":"FindKeyset %q not supported by configserverKeyStore","messagePattern":"FindKeyset %q not supported by configserverKeyStore","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/configserver/keystore.go","lineNumber":41,"sourceCode":"\t\"k8s.io/kops/pkg/pki\"\n\t\"k8s.io/kops/upup/pkg/fi\"\n)\n\n// configserverKeyStore is a KeyStore backed by the config server.\ntype configserverKeyStore struct{}\n\nfunc NewKeyStore() fi.KeystoreReader {\n\treturn &configserverKeyStore{}\n}\n\n// FindPrimaryKeypair implements pki.Keystore\nfunc (s *configserverKeyStore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {\n\treturn nil, nil, fmt.Errorf(\"FindPrimaryKeypair %q not supported by configserverKeyStore\", name)\n}\n\n// FindKeyset implements KeystoreReader.\nfunc (s *configserverKeyStore) FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) {\n\treturn nil, fmt.Errorf(\"FindKeyset %q not supported by configserverKeyStore\", name)\n}\n","sourceCodeStart":23,"sourceCodeEnd":43,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/configserver/keystore.go#L23-L43","documentation":"configserverKeyStore intentionally returns this error from FindKeyset because the config-server backend does not serve keysets through this store implementation. Any attempt to read keyset material via this stub fails unconditionally. It signals that keyset lookup is unsupported for the configserver state store in this code path.","triggerScenarios":"Calling configserverKeyStore.FindKeyset(ctx, name) for any keyset name, e.g. from keystore consumers building cluster secrets or TLS material against a config-server state store.","commonSituations":"Configuring kOps with a config-server state store while a component performs keyset reads locally; misconfigured KOPS_STATE_STORE pointing at configserver for operations that need local key material.","solutions":["Ensure key material is fetched from the config server itself rather than the local keystore stub","Use a supported state store backend that implements FindKeyset","Upgrade kOps so the code path uses config-server APIs instead of local keyset reads"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if isConfigServerStore(store) {\n\treturn fetchKeysetFromConfigServer(ctx, name)\n}\nks, err := store.FindKeyset(ctx, name)","typeGuard":"type keysetReader interface{ FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) }\nif _, ok := store.(keysetReader); !ok { /* use config-server client instead */ }","tryCatchPattern":null,"preventionTips":["Do not point legacy keystore consumers at a configserver state store","Fetch key material via config-server APIs when using configserver","Document which state store backends support keyset reads"],"tags":["keystore","configserver","unsupported-operation"],"backgroundTag":"keystore-keyset-not-supported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}