{"record":{"id":"68ff0c72ba1d6922","repo":"kubernetes/kops","slug":"server-side-client-does-not-support-listkeysets","errorCode":null,"errorMessage":"server-side client does not support ListKeysets","messagePattern":"server-side client does not support ListKeysets","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/keystore.go","lineNumber":75,"sourceCode":"\tif !ok {\n\t\treturn nil, nil\n\t}\n\treturn keySet, nil\n}\n\n// StoreKeyset writes a Keyset to the store.\nfunc (k *keystore) StoreKeyset(ctx context.Context, name string, keyset *fi.Keyset) error {\n\treturn fmt.Errorf(\"server-side client does not support StoreKeyset\")\n}\n\n// MirrorTo will copy secrets to a vfs.Path, which is often easier for a machine to read\nfunc (k *keystore) MirrorTo(ctx context.Context, basedir vfs.Path) error {\n\treturn fmt.Errorf(\"server-side client does not support MirrorTo\")\n}\n\n// ListKeysets will return all the KeySets.\nfunc (k *keystore) ListKeysets() (map[string]*fi.Keyset, error) {\n\treturn nil, fmt.Errorf(\"server-side client does not support ListKeysets\")\n}\n\nfunc newKeystore(basePath string, cas []string) (*keystore, map[string]string, error) {\n\tkeystore := &keystore{\n\t\tkeys:    map[string]keystoreEntry{},\n\t\tkeySets: map[string]*fi.Keyset{},\n\t}\n\tfor _, name := range cas {\n\t\tcertBytes, err := os.ReadFile(path.Join(basePath, name+\".crt\"))\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"reading %q certificate: %v\", name, err)\n\t\t}\n\t\t// TODO: Support multiple certificates?\n\t\tcertificate, err := pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"parsing %q certificate: %v\", name, err)\n\t\t}\n","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/keystore.go#L57-L93","documentation":"ListKeysets enumerates all keysets in a store; the server-side kops-controller keystore only loads a fixed, preconfigured set of CAs into memory and cannot enumerate the cluster's full keyset list, so it returns this stub error unconditionally.","triggerScenarios":"Any call to keystore.ListKeysets on the server-side keystore, e.g. code paths that audit or list all keysets assuming a full CAStore implementation.","commonSituations":"Operations/UI code listing all CAs routed against the controller's in-memory store; tests or tooling reusing the server keystore where a complete store is expected.","solutions":["Use the cluster's vfs/etcd-backed keystore for listing all keysets instead of the server-side keystore","If only the served CAs are needed, use the keypair IDs / keySets loaded at startup rather than ListKeysets","Handle the not-supported error explicitly in callers that may run server-side"],"exampleFix":"// before\nkeysets, err := ks.ListKeysets()\n\n// after\nkeysets, err := clusterKeystore.ListKeysets() // cluster-backed store\n// or, server-side: iterate k.keypairIDs / loaded keySets directly","handlingStrategy":"validation","validationCode":"// Only enumerate keysets on stores that support it; derive served CAs from config otherwise\nif isServerSideKeystore(ks) {\n\tkeysets := servedKeysetsFromConfig(keypairIDs) // map from loaded keypair-ids.yaml\n\treturn keysets, nil\n}","typeGuard":"type fullKeysetLister interface{ ListKeysets() (map[string]*fi.Keyset, error) }\nfunc supportsListKeysets(s pki.Keystore) bool {\n\t_, ok := s.(fullKeysetLister)\n\treturn ok && !isServerSideKeystore(s)\n}","tryCatchPattern":"keysets, err := ks.ListKeysets()\nif err != nil {\n\tif strings.Contains(err.Error(), \"does not support ListKeysets\") {\n\t\treturn enumerateLoadedKeysets(ks), nil\n\t}\n\treturn nil, err\n}","preventionTips":["Use the cluster-backed keystore whenever full enumeration is required","Server-side, iterate the CAs loaded from keypair-ids.yaml instead of listing the store","Type-assert store capabilities before calling enumeration methods","Keep audit/list tooling out of the kops-controller server keystore"],"tags":["keystore","read-only","unsupported-operation","kops-controller"],"backgroundTag":"unsupported-operation","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}