{"record":{"id":"8ef230c2eaceef97","repo":"kubernetes/kops","slug":"reading-keyset-for-s-v","errorCode":null,"errorMessage":"reading keyset for %s: %v","messagePattern":"reading keyset for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/issue_cert.go","lineNumber":227,"sourceCode":"func (s staticKeystore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {\n\tif name != s.keyset {\n\t\treturn nil, nil, fmt.Errorf(\"wrong signer: expected %q got %q\", s.keyset, name)\n\t}\n\treturn s.certificate, s.key, nil\n}\n\nfunc newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {\n\tif signer == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif keypairID == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing keypairID for signer %s\", signer)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading keyset for %s: %v\", signer, err)\n\t}\n\tif keyset == nil {\n\t\treturn nil, fmt.Errorf(\"keyset %q not found\", signer)\n\t}\n\n\titem := keyset.Items[keypairID]\n\tif item == nil {\n\t\treturn nil, fmt.Errorf(\"no keypair with id %s for %s\", keypairID, signer)\n\t}\n\n\treturn &staticKeystore{\n\t\tkeyset:      signer,\n\t\tcertificate: item.Certificate,\n\t\tkey:         item.PrivateKey,\n\t}, nil\n}\n","sourceCodeStart":209,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/issue_cert.go#L209-L244","documentation":"While resolving the signer's keyset from the keystore reader, FindKeyset returned an error; it is wrapped with the signer name. This is a read/transport failure against the cluster keystore, not a 'not found' case.","triggerScenarios":"newStaticKeystore calls keystore.FindKeyset(ctx, signer) during IssueCert Run and the underlying store errors (VFS/backend failure).","commonSituations":"State store unreachable (S3/GCS permissions, network); corrupted keyset YAML in the state store; node cannot reach the cluster state backend during bootstrap.","solutions":["Check the inner error for the store backend failure (permissions, network, not-found parse errors)","Verify node IAM/credentials can read the state store pki paths","Validate the keyset file in the state store parses (e.g. kops get keysets / inspect YAML)","Retry nodeup once the backend is reachable"],"exampleFix":"// before\n// node role lacks s3:GetObject on pki keyset objects\n// after\n// add s3:GetObject on <state-store>/<cluster>/pki/* to the node instance profile","handlingStrategy":"retry","validationCode":"// pre-check store reachability\nctx, cancel := context.WithTimeout(ctx, 10*time.Second)\ndefer cancel()\n_, err := keystoreReader.FindKeyset(ctx, signer) // surface early","typeGuard":null,"tryCatchPattern":"ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)\nif err != nil && strings.HasPrefix(err.Error(), \"reading keyset\") {\n  return fi.NewTryAgainLaterError(\"keystore temporarily unreadable\")\n}","preventionTips":["Verify node IAM roles can read the state store pki prefix","Monitor state-store availability before rolling nodes","Keep keyset YAML valid; avoid manual edits"],"tags":["nodeup","keystore","vfs"],"backgroundTag":"keystore-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}