{"record":{"id":"6420f8978b5f4b00","repo":"kubernetes/kops","slug":"error-storing-keypair-w","errorCode":null,"errorMessage":"error storing keypair: %w","messagePattern":"error storing keypair: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/trust_keypair.go","lineNumber":132,"sourceCode":"\t}\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"keyset %q not found\", options.Keyset)\n\t}\n\n\tfor _, id := range options.KeypairIDs {\n\t\titem := keyset.Items[id]\n\t\tif item == nil {\n\t\t\treturn fmt.Errorf(\"keypair not found\")\n\t\t}\n\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\titem.DistrustTimestamp = nil\n\n\t\tif err := keyStore.StoreKeyset(ctx, options.Keyset, keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error storing keypair: %w\", err)\n\t\t}\n\n\t\tfmt.Fprintf(out, \"Trusted %s %s\\n\", options.Keyset, id)\n\t}\n\n\treturn nil\n}\n\nfunc completeTrustKeyset(ctx context.Context, f commandutils.Factory, options *TrustKeypairOptions, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\tcommandutils.ConfigureKlogForCompletion()\n\n\tcluster, clientSet, completions, directive := GetClusterForCompletion(ctx, f, nil)\n\tif cluster == nil {\n\t\treturn completions, directive\n\t}\n\n\tkeyset, _, completions, directive := completeKeyset(ctx, cluster, clientSet, args, func(name string, keyset *fi.Keyset) bool {\n\t\tif name == \"all\" {","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/trust_keypair.go#L114-L150","documentation":"After clearing DistrustTimestamp on a keypair item, `kops trust keypair` persists the whole keyset via StoreKeyset. If the underlying key store (S3, GCS, etcd-backed, filesystem, etc.) fails to write, the error is wrapped as `error storing keypair: %w`. The trust operation failed to persist and the keyset in the store is unchanged or in an unknown state.","triggerScenarios":"StoreKeyset returns an error: backend connectivity failure (S3/GCS/etcd unreachable or permission denied), the key store is read-only (e.g. vacuumed/published keysets in a read-only registry backend), concurrent modification conflicts, or the backend rejects the write due to validation.","commonSituations":"Expired or missing cloud credentials; IAM policy lacking PutObject on the state-store bucket; etcd key store unavailable during control-plane maintenance; network outage in CI; state store bucket write-protected.","solutions":["Read the wrapped %w cause to identify the backend error and fix credentials/permissions or connectivity for the state store","Retry `kops trust keypair` after backend access is restored","Verify backend health directly (e.g. `kops get clusters`, aws s3 ls / etcdctl) before retrying","Check no conflicting concurrent kops write is holding a lock on the cluster state"],"exampleFix":"// before\nexport AWS_PROFILE=wrong-profile\nkops trust keypair --name c.k8s.local ca 20210101000000\n// after\nexport AWS_PROFILE=ops-admin   # profile with state-store write access\nkops trust keypair --name c.k8s.local ca 20210101000000","handlingStrategy":"retry","validationCode":"if err := store.HealthCheck(ctx); err != nil { // e.g. test-list the bucket/etcd\n\treturn fmt.Errorf(\"key store unavailable before trust: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"err := keyStore.StoreKeyset(ctx, name, keyset)\nvar retriable = errors.Is(err, context.DeadlineExceeded) || isBackendUnavailable(err)\nif err != nil {\n\tif retriable {\n\t\t// backoff and retry the whole TrustKeypair operation\n\t} else {\n\t\t// fix credentials/IAM or read-only backend, then retry manually\n\t}\n\treturn fmt.Errorf(\"error storing keypair: %w\", err)\n}","preventionTips":["Pre-flight the state store with a cheap read/write before mutations","Keep cloud credentials fresh (aws sso login / gcloud auth) in automation","Avoid concurrent kops mutations on the same cluster","Wrap StoreKeyset calls with bounded backoff retry"],"tags":["cli","keystore","persistence","aws"],"backgroundTag":"keystore-write-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}