{"record":{"id":"9d2eeb6fe26272d5","repo":"kubernetes/kops","slug":"error-listing-keysets-v-9d2eeb","errorCode":null,"errorMessage":"error listing Keysets: %v","messagePattern":"error listing Keysets: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":190,"sourceCode":"\t}\n\tif keyset.Primary == nil {\n\t\treturn nil, nil, nil\n\t}\n\tif keyset.Primary.Certificate == nil {\n\t\treturn nil, nil, nil\n\t}\n\treturn keyset.Primary.Certificate, keyset.Primary.PrivateKey, nil\n}\n\n// ListKeysets implements CAStore::ListKeysets\nfunc (c *ClientsetCAStore) ListKeysets() (map[string]*Keyset, error) {\n\tctx := context.TODO()\n\titems := map[string]*Keyset{}\n\n\t{\n\t\tlist, err := c.clientset.Keysets(c.namespace).List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing Keysets: %v\", err)\n\t\t}\n\n\t\tfor i := range list.Items {\n\t\t\tkeyset := &list.Items[i]\n\t\t\tswitch keyset.Spec.Type {\n\t\t\tcase kops.SecretTypeKeypair:\n\t\t\t\titem, err := parseKeyset(keyset)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"parsing keyset %q: %w\", keyset.Name, err)\n\t\t\t\t}\n\n\t\t\t\titems[keyset.Name] = item\n\n\t\t\tcase kops.SecretTypeSecret:\n\t\t\t\tcontinue // Ignore - this is handled by ClientsetSecretStore\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"unhandled secret type %q: %v\", keyset.Spec.Type, err)\n\t\t\t}","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L172-L208","documentation":"ListKeysets lists all Keyset objects in the store's namespace; any List API error (other than being wrapped per-item) is returned as 'error listing Keysets: <underlying>'. This blocks building the keyset map used e.g. by MirrorTo. From upup/pkg/fi/clientset_castore.go:190.","triggerScenarios":"clientset.Keysets(namespace).List fails: API server unreachable, RBAC forbids listing keysets, context deadline exceeded, bad namespace.","commonSituations":"Running 'kops admin' / CA store mirror operations with credentials lacking list permissions; offline/intranet mode with no API access; expired tokens during long-running operations.","solutions":["Confirm kubectl get keysets -A (or -n <namespace>) works with the same credentials","Fix RBAC to allow listing keysets in the kops system namespace","Restore API server connectivity / refresh expired kubeconfig tokens","Retry if the wrapped error is transient (timeouts, connection resets)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify list permission up front\n_, err := kubeClient.Keysets(ns).List(ctx, metav1.ListOptions{})\nif err != nil {\n\treturn fmt.Errorf(\"list permission check failed in %s: %w\", ns, err)\n}","typeGuard":null,"tryCatchPattern":"items, err := store.ListKeysets()\nif err != nil {\n\tif strings.Contains(err.Error(), \"error listing Keysets\") {\n\t\t// retry with backoff; check RBAC/API health\n\t}\n\treturn err\n}","preventionTips":["Grant list on keysets to the automation identity","Refresh tokens before long-running mirror operations","Add backoff retries for API list calls"],"tags":["go","kubernetes","api-server","list","rbac"],"backgroundTag":"kubernetes-api-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}