{"record":{"id":"65962c3d8fe4759c","repo":"kubernetes/kops","slug":"findprimarykeypair-q-not-supported-by-configserve","errorCode":null,"errorMessage":"FindPrimaryKeypair %q not supported by configserverKeyStore","messagePattern":"FindPrimaryKeypair %q not supported by configserverKeyStore","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/configserver/keystore.go","lineNumber":36,"sourceCode":"\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"k8s.io/kops/pkg/pki\"\n\t\"k8s.io/kops/upup/pkg/fi\"\n)\n\n// configserverKeyStore is a KeyStore backed by the config server.\ntype configserverKeyStore struct{}\n\nfunc NewKeyStore() fi.KeystoreReader {\n\treturn &configserverKeyStore{}\n}\n\n// FindPrimaryKeypair implements pki.Keystore\nfunc (s *configserverKeyStore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {\n\treturn nil, nil, fmt.Errorf(\"FindPrimaryKeypair %q not supported by configserverKeyStore\", name)\n}\n\n// FindKeyset implements KeystoreReader.\nfunc (s *configserverKeyStore) FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) {\n\treturn nil, fmt.Errorf(\"FindKeyset %q not supported by configserverKeyStore\", name)\n}\n","sourceCodeStart":18,"sourceCodeEnd":43,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/configserver/keystore.go#L18-L43","documentation":"configserverKeyStore is a stub KeystoreReader used with the config-server backend that intentionally rejects FindPrimaryKeypair calls, since config-server serves key material only through keysets. Any code path requesting a legacy primary keypair against this store always fails with this sentinel error. It indicates the caller is using an API unsupported by the configserver keystore implementation.","triggerScenarios":"Calling fi.KeystoreReader.FindPrimaryKeypair (or any pki.Keystore consumer such as TLS certificate creation paths) on a keystore obtained from configserver.NewKeyStore().","commonSituations":"Running a cluster configured with the config-server state store while a component (e.g. nodeup/protokube or pki.CA code) still requests primary keypairs instead of keysets; legacy code paths not yet migrated to FindKeyset.","solutions":["Migrate the calling code to use FindKeyset instead of FindPrimaryKeypair","Switch the cluster state store away from configserver (e.g. to a supported VFS store) if legacy keypair lookup is required","Check kOps version compatibility: upgrade components so all paths use the keyset API"],"exampleFix":"// before\nkeypair, err := keystore.(fi.KeystoreReader).FindPrimaryKeypair(ctx, name)\n// after\nkeyset, err := keystore.FindKeyset(ctx, name)","handlingStrategy":"validation","validationCode":"if ks, ok := store.(*configserverKeyStore); ok {\n\treturn fmt.Errorf(\"FindPrimaryKeypair unavailable with configserver state store; use FindKeyset\")\n}\npair, err := store.FindPrimaryKeypair(ctx, name)","typeGuard":"if _, ok := store.(interface{ FindKeyset(context.Context, string) (*fi.Keyset, error) }); !ok {\n\treturn nil, fmt.Errorf(\"keystore does not support keyset lookup\")\n}","tryCatchPattern":null,"preventionTips":["Prefer FindKeyset over FindPrimaryKeypair in new code","Check the state store type before calling legacy keypair APIs","Keep kOps components version-aligned with the state store backend"],"tags":["keystore","configserver","unsupported-operation"],"backgroundTag":"keystore-primary-keypair-not-supported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}