{"record":{"id":"a25dbdb7c69e339e","repo":"kubernetes/kops","slug":"no-keypair-with-id-s-for-s","errorCode":null,"errorMessage":"no keypair with id %s for %s","messagePattern":"no keypair with id (.+?) for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/issue_cert.go","lineNumber":235,"sourceCode":"\tif signer == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif keypairID == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing keypairID for signer %s\", signer)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading keyset for %s: %v\", signer, err)\n\t}\n\tif keyset == nil {\n\t\treturn nil, fmt.Errorf(\"keyset %q not found\", signer)\n\t}\n\n\titem := keyset.Items[keypairID]\n\tif item == nil {\n\t\treturn nil, fmt.Errorf(\"no keypair with id %s for %s\", keypairID, signer)\n\t}\n\n\treturn &staticKeystore{\n\t\tkeyset:      signer,\n\t\tcertificate: item.Certificate,\n\t\tkey:         item.PrivateKey,\n\t}, nil\n}\n","sourceCodeStart":217,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/issue_cert.go#L217-L244","documentation":"The keyset exists but does not contain an item with the requested keypairID, so no certificate/private key pair can be pinned. This means the recorded keypair ID points at a keyset entry that no longer exists.","triggerScenarios":"newStaticKeystore reads keyset.Items[keypairID] and gets nil — the persisted KeypairID (e.g. an old primary) was removed when keysets were rotated/pruned.","commonSituations":"Keypair rotation followed by pruning deleted the referenced id; cluster restored from a partial backup; keypairID copied from a different cluster.","solutions":["Re-run kops update/apply so the task re-resolves to the keyset's current primary keypair","Stop pruning that keyset's items or widen the retention window (kops editor: keyset retention)","Update the IssueCert task's KeypairID to an existing item id","Verify keypairID belongs to this cluster's keyset, not another cluster's"],"exampleFix":"// before\nKeypairID: fi.String(\"6727146218130581431\") // pruned\n// after\nKeypairID: fi.String(keyset.Primary.ID) // current primary id","handlingStrategy":"validation","validationCode":"item, ok := keyset.Items[keypairID]\nif !ok {\n  return fmt.Errorf(\"keypairID %s gone; use primary %s\", keypairID, keyset.Primary.ID)\n}","typeGuard":null,"tryCatchPattern":"ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)\nif err != nil && strings.HasPrefix(err.Error(), \"no keypair with id\") {\n  // re-resolve KeypairID from keyset.Primary.ID and retry once\n}","preventionTips":["Retain rotated keypair items for a grace period before pruning","Store keypairIDs only from the same cluster's keysets","Re-run kops update after keypair rotation so tasks re-pin"],"tags":["nodeup","pki","keypair"],"backgroundTag":"keypair-id-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}