{"record":{"id":"928e536cee196a9d","repo":"kubernetes/kops","slug":"keyset-q-not-found-928e53","errorCode":null,"errorMessage":"keyset %q not found","messagePattern":"keyset %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":251,"sourceCode":"\t\t\treturn err\n\t\t} else if roundtrip == nil {\n\t\t\treturn fmt.Errorf(\"unable to find created certificate %q: %w\", name, err)\n\t\t}\n\n\t\tklog.V(8).Infof(\"created certificate with subject %v\", subjectPkix)\n\t}\n\n\t// TODO: Check correct subject / flags\n\n\tif changeStoredFormat {\n\t\t// We fetch and reinsert the same keypair, forcing an update to our preferred format\n\t\t// TODO: We're assuming that we want to save in the preferred format\n\t\tkeyset, err := c.T.Keystore.FindKeyset(ctx, name)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif keyset == nil {\n\t\t\treturn fmt.Errorf(\"keyset %q not found\", name)\n\t\t}\n\n\t\tkeyset.LegacyFormat = false\n\t\terr = c.T.Keystore.StoreKeyset(ctx, name, keyset)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tklog.Infof(\"updated Keypair %q to new format\", name)\n\t}\n\n\treturn nil\n\n}\n\nfunc CreateKeyset(ctx context.Context, keystore fi.Keystore, name string, req pki.IssueCertRequest) (*fi.Keyset, error) {\n\tkeyset, err := keystore.FindKeyset(ctx, name)\n\tif err != nil {","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L233-L269","documentation":"Render of the keypair task assumes it wants to re-save the keyset in the preferred format. It looks up the keyset by name; when FindKeyset returns nil, the named keyset (certificate/key pair) does not exist in the keystore, so the task fails with this error.","triggerScenarios":"Render calls c.T.Keystore.FindKeyset(ctx, name) for a keypair name that has never been created and is not present in the cluster's keystore (pki directory / secret store).","commonSituations":"Deleted or truncated cluster pki data in the state store, typo'd keypair alternate names, restoring a partial cluster backup, or a keyset expected from a previous keystore migration that never happened.","solutions":["Recreate the missing keyset: run kops with the keypair task enabled (e.g. `kops update cluster`) so the certificate is generated and stored.","Check the state store pki directory (s3://<bucket>/<cluster>/pki/) for the missing keyset and restore it from backup.","Verify the keyset name in the cluster spec / task definitions matches an existing keyset exactly (case-sensitive).","If the keystore uses legacy format, ensure migration ran; missing legacy keysets can appear absent."],"exampleFix":"// before: cluster pki deleted\n// after: restore keyset then re-run\n// kops toolbox dump / manual copy of pki/<name>.keyset back into state store, then:\n// kops update cluster <name> --yes","handlingStrategy":"validation","validationCode":"ks, err := keystore.FindKeyset(ctx, keypairName)\nif err != nil || ks == nil { /* recreate or restore before applying */ }","typeGuard":"if keyset == nil { return fmt.Errorf(\"keyset %q not found\", name) }","tryCatchPattern":"if err != nil { return fmt.Errorf(\"loading keyset %q: %w\", name, err) }","preventionTips":["Never manually delete files under <state-store>/<cluster>/pki/","Snapshot the state store before migrations or upgrades","Confirm keypair names in the cluster spec match existing keysets exactly"],"tags":["keystore","certificate","missing-resource"],"backgroundTag":"keystore-keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}