{"record":{"id":"5688c08f3e794f8c","repo":"kubernetes/kops","slug":"keypair-not-found-5688c0","errorCode":null,"errorMessage":"keypair not found","messagePattern":"keypair not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/trust_keypair.go","lineNumber":122,"sourceCode":"\t}\n\n\tkeyStore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, options.Keyset)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"keyset %q not found\", options.Keyset)\n\t}\n\n\tfor _, id := range options.KeypairIDs {\n\t\titem := keyset.Items[id]\n\t\tif item == nil {\n\t\t\treturn fmt.Errorf(\"keypair not found\")\n\t\t}\n\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\titem.DistrustTimestamp = nil\n\n\t\tif err := keyStore.StoreKeyset(ctx, options.Keyset, keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error storing keypair: %w\", err)\n\t\t}\n\n\t\tfmt.Fprintf(out, \"Trusted %s %s\\n\", options.Keyset, id)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/trust_keypair.go#L104-L140","documentation":"After finding the keyset, `kops trust keypair` iterates the IDs passed via positional args and looks each up in keyset.Items. If a given keypair ID does not exist in that keyset, the command fails with `keypair not found`. The keyset exists but the specific keypair ID is wrong or already removed.","triggerScenarios":"`kops trust keypair --name <cluster> <keyset> <id>` with an ID that is not present in keyset.Items — e.g. a mistyped or stale ID (IDs are typically timestamps like `20220101120000` or old-item hashes), or the keypair was already deleted/garbage-collected from the keyset.","commonSituations":"Copy-pasting a keypair ID from a different cluster or keyset; referencing a distrusted-then-deleted keypair; using an ID format from an older kOps version; running `kops get keypairs` output parsing errors that truncated the ID.","solutions":["Run `kops get keypairs --name <cluster> <keyset>` and copy the exact ID from the output","Verify you are targeting the right cluster/keyset that actually contains the ID","If the keypair is gone, recreate the keypair instead of trusting it"],"exampleFix":"// before\nkops trust keypair --name c.k8s.local ca 2021   # truncated ID\n// after\nkops get keypairs --name c.k8s.local ca\nkops trust keypair --name c.k8s.local ca 20210101000000","handlingStrategy":"validation","validationCode":"keyset := mustFindKeyset(t)\nfor _, id := range ids {\n\tif keyset.Items[id] == nil {\n\t\treturn fmt.Errorf(\"keypair %q not in keyset %q; known IDs: %v\", id, keyset.Name, slices.Collect(maps.Keys(keyset.Items)))\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy keypair IDs verbatim from `kops get keypairs` output, never by hand","Confirm the ID belongs to the same cluster/keyset you are targeting","Watch for kOps output formatting truncating long IDs in terminal width"],"tags":["cli","keypairs","keystore"],"backgroundTag":"keypair-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}