{"record":{"id":"381512c1e7ba50c3","repo":"kubernetes/kops","slug":"keyset-q-not-found-381512","errorCode":null,"errorMessage":"keyset %q not found","messagePattern":"keyset %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/issue_cert.go","lineNumber":230,"sourceCode":"\t}\n\treturn s.certificate, s.key, nil\n}\n\nfunc newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {\n\tif signer == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif keypairID == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing keypairID for signer %s\", signer)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading keyset for %s: %v\", signer, err)\n\t}\n\tif keyset == nil {\n\t\treturn nil, fmt.Errorf(\"keyset %q not found\", signer)\n\t}\n\n\titem := keyset.Items[keypairID]\n\tif item == nil {\n\t\treturn nil, fmt.Errorf(\"no keypair with id %s for %s\", keypairID, signer)\n\t}\n\n\treturn &staticKeystore{\n\t\tkeyset:      signer,\n\t\tcertificate: item.Certificate,\n\t\tkey:         item.PrivateKey,\n\t}, nil\n}\n","sourceCodeStart":212,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/issue_cert.go#L212-L244","documentation":"FindKeyset succeeded but returned a nil keyset, meaning no keyset exists under the requested signer name. The function reports it plainly with the signer name quoted.","triggerScenarios":"newStaticKeystore looks up e.g. \"kubernetes-ca\" and the store has no such keyset (name never created, renamed, or deleted).","commonSituations":"Signer renamed between kOps versions or in a customized spec; state store pruned of old keysets; typo in the signer name; cluster migrated without copying pki data.","solutions":["List keysets in the state store and use the actual keyset name in the IssueCert Signer field","Create/re-issue the CA keyset if it is genuinely missing (kops will regenerate on apply)","Check for renamed signers after upgrading kOps and update the cluster spec","Restore pki data from backup if it was deleted"],"exampleFix":"// before\nSigner: fi.String(\"etcd-clients-ca\") // keyset deleted from store\n// after\nSigner: fi.String(\"etcd-clients-ca\") + run `kops update cluster` to recreate the keyset","handlingStrategy":"validation","validationCode":"keyset, _ := keystoreReader.FindKeyset(ctx, signer)\nif keyset == nil {\n  return fmt.Errorf(\"keyset %q missing; run kops update cluster to create it\", signer)\n}","typeGuard":null,"tryCatchPattern":"ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)\nif err != nil && strings.Contains(err.Error(), \"keyset \\\"\"+signer+\"\\\" not found\") {\n  // trigger keyset recreation via kops apply before re-running nodeup\n}","preventionTips":["Never prune CA keysets referenced by cert tasks","After kOps upgrades, diff signer names in specs","Back up the state store pki directory"],"tags":["nodeup","keystore","keyset-missing"],"backgroundTag":"keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}