{"record":{"id":"35ed6adab501e73e","repo":"kubernetes/kops","slug":"key-q-not-found","errorCode":null,"errorMessage":"key %q not found","messagePattern":"key %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/nodemodel/nodeupconfigbuilder.go","lineNumber":466,"sourceCode":"\t\tconfigServer.TLSServerName = kopsControllerName\n\t}\n\n\tfor _, host := range hosts {\n\t\tbaseURL := url.URL{\n\t\t\tScheme: \"https\",\n\t\t\tHost:   net.JoinHostPort(host, strconv.Itoa(wellknownports.KopsControllerPort)),\n\t\t\tPath:   \"/\",\n\t\t}\n\t\tconfigServer.Servers = append(configServer.Servers, baseURL.String())\n\t}\n\n\treturn configServer\n}\n\nfunc loadCertificates(keysets map[string]*fi.Keyset, name string, config *nodeup.Config, includeKeypairID bool) error {\n\tkeyset := keysets[name]\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"key %q not found\", name)\n\t}\n\tcertificates, err := keyset.ToCertificateBytes()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read %q certificates: %w\", name, err)\n\t}\n\tconfig.CAs[name] = string(certificates)\n\tif includeKeypairID {\n\t\tif keyset.Primary == nil || keyset.Primary.Id == \"\" {\n\t\t\treturn fmt.Errorf(\"key %q did not have primary id set\", name)\n\t\t}\n\t\tconfig.KeypairIDs[name] = keyset.Primary.Id\n\t}\n\treturn nil\n}\n\n// buildWarmPoolImages returns a list of container images that should be pre-pulled during instance pre-initialization\nfunc (n *nodeUpConfigBuilder) buildWarmPoolImages(ig *kops.InstanceGroup) []string {\n\tif ig == nil || ig.Spec.Role.HasControlPlane() {","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodemodel/nodeupconfigbuilder.go#L448-L484","documentation":"loadCertificates populates the nodeup config's CA trust store (config.CAs) from a map of fi.Keyset objects built by BuildConfig. This error is thrown when the keyset map has no entry for the requested key name, meaning a required keypair (e.g. kubernetes-ca, etcd-clients-ca) was never loaded or does not exist in the cluster's key store.","triggerScenarios":"BuildConfig calls loadCertificates for each required key name (nodeup config for a node/control-plane instance group); if a key such as \"kubernetes-ca\" or \"etcd-clients-ca\" is missing from the keyset map — because it was never created, was deleted from the key store, or the builder skipped loading it for that role — the error fires.","commonSituations":"Cluster keypair store damaged or partially deleted (kops get secrets shows missing keys); building nodeup config for a control-plane node in a cluster whose etcd CA keysets were never provisioned; upgrading kOps versions where new keysets (e.g. service-account) must exist but `kops update cluster` was never run to create them; pointing kOps at a cluster with an incomplete state store.","solutions":["Run `kops update cluster <name> --yes` (or `kops create`) so kOps regenerates the missing keyset in the key store, then retry.","List existing keypairs with `kops get secrets` / the keypair API to confirm which key is missing; check the quoted name in the error.","If keypairs were deleted, restore from the state store backup or rotate: `kops toolbox pki` / keypair rotation docs to recreate the CA.","Verify the state store (KOPS_STATE_STORE) points at the right cluster so the builder reads the correct key store."],"exampleFix":"// before: nodeup config built without running cluster update\n$ kops replace -f cluster.yaml && kops create secrets never run\n// after\n$ kops update cluster mycluster.k8s.local --yes   # creates missing kubernetes-ca et al.","handlingStrategy":"try-catch","validationCode":"names := []string{\"kubernetes-ca\", \"etcd-clients-ca\", \"etcd-peers-ca\", ...}\nfor _, name := range names {\n    if keysets[name] == nil {\n        return fmt.Errorf(\"required keyset %q missing; run kops update cluster to create it\", name)\n    }\n}","typeGuard":"func keysetExists(keysets map[string]*fi.Keyset, name string) bool {\n    ks, ok := keysets[name]\n    return ok && ks != nil\n}","tryCatchPattern":"if err := loadCertificates(keysets, \"kubernetes-ca\", config, true); err != nil {\n    if strings.Contains(err.Error(), \"not found\") {\n        // regenerate missing keysets via kops update cluster before retrying\n        return fmt.Errorf(\"cluster keystore incomplete (%w); run 'kops update cluster --yes'\", err)\n    }\n    return err\n}","preventionTips":["Always run `kops update cluster <name> --yes` after upgrading kOps so newly required keysets are created","Periodically verify keypairs with `kops get keypairs` and alert on missing required keysets","Never manually delete files under the state store's keys/ directory; use kops keypair commands","Back up the state store so deleted CA keysets can be restored"],"tags":["pki","keypair","certificates","nodeup","key-missing"],"backgroundTag":"missing-keypair-keyset","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}