{"record":{"id":"6af735a568aa7bb7","repo":"kubernetes/kops","slug":"reading-q-key-v","errorCode":null,"errorMessage":"reading %q key: %v","messagePattern":"reading %q key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/keystore.go","lineNumber":96,"sourceCode":"func newKeystore(basePath string, cas []string) (*keystore, map[string]string, error) {\n\tkeystore := &keystore{\n\t\tkeys:    map[string]keystoreEntry{},\n\t\tkeySets: map[string]*fi.Keyset{},\n\t}\n\tfor _, name := range cas {\n\t\tcertBytes, err := os.ReadFile(path.Join(basePath, name+\".crt\"))\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"reading %q certificate: %v\", name, err)\n\t\t}\n\t\t// TODO: Support multiple certificates?\n\t\tcertificate, err := pki.ParsePEMCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"parsing %q certificate: %v\", name, err)\n\t\t}\n\n\t\tkeyBytes, err := os.ReadFile(path.Join(basePath, name+\".key\"))\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"reading %q key: %v\", name, err)\n\t\t}\n\t\tkey, err := pki.ParsePEMPrivateKey(keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"parsing %q key: %v\", name, err)\n\t\t}\n\n\t\tkeystore.keys[name] = keystoreEntry{\n\t\t\tcertificate: certificate,\n\t\t\tkey:         key,\n\t\t}\n\t}\n\n\tvar keypairIDs map[string]string\n\tkeypairIDsBytes, err := os.ReadFile(path.Join(basePath, \"keypair-ids.yaml\"))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"reading keypair-ids.yaml\")\n\t}\n\tif err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/keystore.go#L78-L114","documentation":"newKeystore reads the <name>.key private-key file for a CA from the CA base path; this wraps os.ReadFile failing, i.e. the key file is missing, unreadable, or has wrong permissions. The matching certificate was already loaded successfully.","triggerScenarios":"Thrown at cmd/kops-controller/pkg/server/keystore.go:96 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure <name>.key exists next to <name>.crt in the CABasePath","Fix file permissions so kops-controller can read the key","Regenerate the keypair if the key was lost"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}