{"record":{"id":"346f4015f491b910","repo":"kubernetes/kops","slug":"creating-keypair-for-s-v","errorCode":null,"errorMessage":"creating keypair for %s: %v","messagePattern":"creating keypair for (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":178,"sourceCode":"\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn createKeypair(ctx, out, options, options.Keyset, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := createKeypair(ctx, out, options, name, keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"creating keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc createKeypair(ctx context.Context, out io.Writer, options *CreateKeypairOptions, name string, keyStore fi.CAStore) error {\n\tvar err error\n\tvar privateKey *pki.PrivateKey\n\tif options.PrivateKeyPath != \"\" {\n\t\toptions.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)\n\t\tprivateKeyBytes, err := os.ReadFile(options.PrivateKeyPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading user provided private key %q: %v\", options.PrivateKeyPath, err)\n\t\t}\n\n\t\tprivateKey, err = pki.ParsePEMPrivateKey(privateKeyBytes)","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L160-L196","documentation":"When iterating keysets under `--keyset all`, if createKeypair fails for one rotatable keyset, the loop aborts and wraps the per-keyset error with \"creating keypair for <name>\". The embedded error is the real cause (e.g. an error from errors 248/249 or keystore writes).","triggerScenarios":"`--keyset all` where any rotatable keyset's createKeypair call errors (cmd/kops/create_keypair.go:178). Note: processing stops at the first failing keyset.","commonSituations":"One keyset in a bad state (corrupt existing keypair) while others rotate fine; provided --key incompatible with a particular keyset's algorithm; partial rotation leaves some keysets rotated and others not.","solutions":["Read the wrapped inner error to identify the failing keyset.","Rotate that keyset individually with --keyset <name> to debug in isolation.","Ensure the provided --key/--cert is compatible with all rotatable keysets, or rotate without them.","Re-run `--keyset all` after fixing; kOps keeps track of primary keys per keyset."],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset all --key ./rsa.key   # fails on service-account keyset\n// after\nkops create keypair cluster.k8s.local --keyset ca --key ./rsa.key\nkops create keypair cluster.k8s.local --keyset service-account   # generate instead","handlingStrategy":"fallback","validationCode":"# pre-check each rotatable keyset is readable before bulk rotation\nfor ks in ca service-account; do\n  kops get keypairs \"$CLUSTER\" --keyset \"$ks\" >/dev/null || { echo \"keyset $ks unhealthy\"; exit 1; }\ndone","typeGuard":null,"tryCatchPattern":"if ! out=$(kops create keypair \"$CLUSTER\" --keyset all 2>&1); then\n  ks=$(echo \"$out\" | sed -n 's/.*creating keypair for \\([^:]*\\).*/\\1/p')\n  echo \"isolating failure in keyset: $ks\"\n  kops create keypair \"$CLUSTER\" --keyset \"$ks\" || exit 1\n  # continue with remaining keysets individually\nfi","preventionTips":["Prefer per-keyset rotation loops over `all` in automation for better error isolation.","Inspect the wrapped inner error before retrying the whole batch.","Keep backups of the pki directory to recover from partial rotations."],"tags":["keypair","rotation","batch-operation","kops"],"backgroundTag":"partial-batch-rotation-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}