{"record":{"id":"6b41e70429ce1bac","repo":"kubernetes/kops","slug":"reading-keypair-ids-yaml","errorCode":null,"errorMessage":"reading keypair-ids.yaml","messagePattern":"reading keypair-ids\\.yaml","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/keystore.go","lineNumber":112,"sourceCode":"\t\tkeyBytes, err := os.ReadFile(path.Join(basePath, name+\".key\"))\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"reading %q key: %v\", name, err)\n\t\t}\n\t\tkey, err := pki.ParsePEMPrivateKey(keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"parsing %q key: %v\", name, err)\n\t\t}\n\n\t\tkeystore.keys[name] = keystoreEntry{\n\t\t\tcertificate: certificate,\n\t\t\tkey:         key,\n\t\t}\n\t}\n\n\tvar keypairIDs map[string]string\n\tkeypairIDsBytes, err := os.ReadFile(path.Join(basePath, \"keypair-ids.yaml\"))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"reading keypair-ids.yaml\")\n\t}\n\tif err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"parsing keypair-ids.yaml\")\n\t}\n\n\t// Build keysets\n\tfor name, keypairID := range keypairIDs {\n\t\tentry, found := keystore.keys[name]\n\t\tif !found {\n\t\t\t// keypair-ids.yaml also includes CAs this server is not configured to serve (e.g. the etcd CAs).\n\t\t\tklog.V(2).Infof(\"keypair %q found in keypair IDs, not loaded as a served CA\", name)\n\t\t\tcontinue\n\t\t}\n\t\tprimary := &fi.KeysetItem{}\n\t\tprimary.Id = keypairID\n\t\tprimary.Certificate = entry.certificate\n\t\tprimary.PrivateKey = entry.key\n","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/keystore.go#L94-L130","documentation":"newKeystore reads keypair-ids.yaml from the CA base path to map keyset names to cloud keypair IDs; this error (note: it drops the underlying err) fires when that file cannot be read - missing, unreadable, or bad permissions. The CA certs and keys themselves loaded fine.","triggerScenarios":"Thrown at cmd/kops-controller/pkg/server/keystore.go:112 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create a valid keypair-ids.yaml in the CABasePath","Fix file permissions so kops-controller can read it","Verify the file was not accidentally deleted during CA setup"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}