{"record":{"id":"87db3b120d0831a4","repo":"kubernetes/kops","slug":"getting-keyset-q-w","errorCode":null,"errorMessage":"getting keyset %q: %w","messagePattern":"getting keyset %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":822,"sourceCode":"\t}\n\n\tconfigBuilder, err := nodemodel.NewNodeUpConfigBuilder(cluster, assetBuilder, encryptionConfigSecretHash)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeysets := make(map[string]*fi.Keyset)\n\n\tkeystore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeyNames := model.KeypairNamesForInstanceGroup(cluster, ig)\n\tfor _, keyName := range keyNames {\n\t\tkeyset, err := keystore.FindKeyset(ctx, keyName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting keyset %q: %w\", keyName, err)\n\t\t}\n\n\t\tif keyset == nil {\n\t\t\treturn nil, fmt.Errorf(\"did not find keyset %q\", keyName)\n\t\t}\n\n\t\tkeysets[keyName] = keyset\n\t}\n\n\tnodeupConfig, bootConfig, err := configBuilder.BuildConfig(ig, wellKnownAddresses, keysets)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar nodeupScript resources.NodeUpScript\n\tnodeupScript.NodeUpAssets = nodeUpAssets.NodeUpAssets\n\tnodeupScript.BootConfig = bootConfig\n","sourceCodeStart":804,"sourceCodeEnd":840,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L804-L840","documentation":"GetBootstrapData resolves the keypair names for the instance group and loads each keyset from the keyset store with keystore.FindKeyset. A storage/decoding failure (not a missing entry) is wrapped as 'getting keyset %q: %w'. Missing entries return nil,nil and hit the separate 'did not find keyset' error.","triggerScenarios":"FindKeyset returning an error when reading from the state store: corrupted keyset YAML/JSON, backend I/O failure, permission denied on the S3/GS object, or version incompatibility of stored keyset format.","commonSituations":"State store object encrypted with a KMS key the caller cannot access; truncated/corrupted object after interrupted kops operation; bucket policy change removing s3:GetObject; kops version upgrade changing keyset serialization expectations.","solutions":["Read the wrapped cause to see if it's I/O, permission, or decode failure.","Verify read permissions on the state store path (e.g. s3://bucket/cluster/pki/keysets/<name>).","Inspect/repair the keyset object; restore from backup if corrupted.","Ensure the kops binary version matches the one that wrote the keysets."],"exampleFix":"// before\nkeyset, err := keystore.FindKeyset(ctx, keyName)\nif err != nil { return nil, fmt.Errorf(\"getting keyset %q: %w\", keyName, err) }\n// after\n// grant s3:GetObject on the pki prefix, then retry:\n// aws s3 cp s3://bucket/cluster/pki/keysets/<name>/ -  # verify object is readable & valid","handlingStrategy":"try-catch","validationCode":"// Check keyset objects are readable before enrollment\n// aws s3 cp s3://bucket/cluster/pki/keysets/<name>/ - > /dev/null","typeGuard":null,"tryCatchPattern":"if err != nil {\n\tvar permErr *AccessDeniedError\n\tif errors.As(err, &permErr) {\n\t\treturn fmt.Errorf(\"keyset %q unreadable: check state store IAM/KMS: %w\", keyName, err)\n\t}\n\treturn fmt.Errorf(\"getting keyset %q: %w\", keyName, err)\n}","preventionTips":["Keep KMS keys and bucket policies granting the operator read access to pki/","Back up the pki/ prefix of the state store","Avoid mixing kops versions that change keyset serialization"],"tags":["kops","keyset","keystore","state-store"],"backgroundTag":"keyset-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}