{"record":{"id":"6686c03d0443fc88","repo":"kubernetes/kops","slug":"reading-existing-keyset-v","errorCode":null,"errorMessage":"reading existing keyset: %v","messagePattern":"reading existing keyset: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":247,"sourceCode":"\t\tcert, err = pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading certificate %q: %v\", options.CertPath, err)\n\t\t}\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tvar item *fi.KeysetItem\n\tif os.IsNotExist(err) || (err == nil && keyset == nil) {\n\t\tif options.Primary {\n\t\t\tif keyset, err = fi.NewKeyset(cert, privateKey); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"the first keypair added to a keyset must be primary\")\n\t\t}\n\t\titem = keyset.Primary\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"reading existing keyset: %v\", err)\n\t} else {\n\t\titem, err = keyset.AddItem(cert, privateKey, options.Primary)\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = keyStore.StoreKeyset(ctx, name, keyset)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error storing user provided keys %q %q: %v\", options.CertPath, options.PrivateKeyPath, err)\n\t}\n\n\tif options.CertPath != \"\" {\n\t\tfmt.Fprintf(out, \"using user provided cert: %v\\n\", options.CertPath)\n\t}\n\tif options.PrivateKeyPath != \"\" {\n\t\tfmt.Fprintf(out, \"using user provided private key: %v\\n\", options.PrivateKeyPath)\n\t}","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L229-L265","documentation":"This error wraps a failure from keyStore.FindKeyset while `kops create keypair` looks up the existing keyset. It fires when the lookup fails with an error other than not-exist, meaning the keyset state could not be read from the backing store (S3/GCS state store or kubernetes backend).","triggerScenarios":"Calling `kops create keypair` when the key store backend is unreachable, returns permission errors, or has corrupted keyset data for the given name — anything from FindKeyset that is neither nil nor os.IsNotExist.","commonSituations":"Expired/missing cloud credentials (AWS_PROFILE, session tokens); network outage to S3/GCS; wrong --state / KOPS_STATE_STORE value; corrupted keyset object in the store.","solutions":["Check backend connectivity and credentials with a read command like `kops get cluster`.","Verify the --state flag / KOPS_STATE_STORE value is correct.","Inspect backend permissions (bucket policy, IAM) for read access to the keyset path.","Retry after transient network errors; inspect stored keyset files for corruption."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight the backend with a cheap read\nif _, err := keyStore.ListKeysets(); err != nil {\n    return fmt.Errorf(\"key store unreachable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"reading existing keyset\") {\n    // check state-store credentials/connectivity, then retry with backoff\n}","preventionTips":["Verify KOPS_STATE_STORE and cloud credentials before kOps commands.","Test backend access with a read-only command first.","Watch for expired session tokens in CI environments."],"tags":["keystore","state-store","io"],"backgroundTag":"state-store-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}