{"record":{"id":"7221890701714910","repo":"kubernetes/kops","slug":"error-getting-keystore-v","errorCode":null,"errorMessage":"error getting keystore: %v","messagePattern":"error getting keystore: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":163,"sourceCode":"// RunCreateKeypair adds a custom CA certificate and private key.\nfunc RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *CreateKeypairOptions) error {\n\tif !rotatableKeysetFilter(options.Keyset, nil) {\n\t\treturn fmt.Errorf(\"adding keypair to %q is not supported\", options.Keyset)\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting cluster: %q: %v\", options.ClusterName, err)\n\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn createKeypair(ctx, out, options, options.Keyset, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := createKeypair(ctx, out, options, name, keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"creating keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L145-L181","documentation":"The command obtains the cluster's key store from the clientset (clientSet.KeyStore(cluster)). A keystore is the abstraction over where keypairs are persisted (e.g. keycert store in the state store); failure to construct it is wrapped with this message.","triggerScenarios":"clientSet.KeyStore(cluster) errors during `kops create keypair` — misconfigured or unsupported keystore backend for the cluster (cmd/kops/create_keypair.go:163).","commonSituations":"Cluster config references a key store backend the CLI can't instantiate; corrupted cluster registry data; older clusters migrated between kOps versions with changed keystore defaults.","solutions":["Inspect the cluster spec's keystore configuration (`kops get cluster -o yaml`).","Use a kOps version matching the one that created the cluster.","Verify state store permissions and integrity of the cluster manifest.","Run `kops toolbox dump` / `kops validate cluster` to check overall cluster config health."],"exampleFix":"// before\n# keystore misconfigured in cluster spec; create keypair fails\n// after\nkops edit cluster cluster.k8s.local  # fix/restore default keystore config\nkops update cluster --yes && kops create keypair cluster.k8s.local --keyset ca","handlingStrategy":"try-catch","validationCode":"kops get cluster \"$CLUSTER\" -o yaml >/dev/null 2>&1 || { echo \"cluster spec unreadable; keystore cannot be built\"; exit 1; }","typeGuard":null,"tryCatchPattern":"if ! out=$(kops create keypair \"$CLUSTER\" --keyset ca 2>&1); then\n  case \"$out\" in\n    *\"error getting keystore\"*) echo \"Inspect cluster keystore config: $out\"; kops get cluster \"$CLUSTER\" -o yaml;;\n  esac\nfi","preventionTips":["Do not hand-edit the cluster manifest's key store settings.","Run `kops update cluster` after version upgrades so store layout migrates.","Back up the state store before keystore-touching operations."],"tags":["keystore","keypair","kops"],"backgroundTag":"keystore-initialization-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}