{"record":{"id":"b5297195e79d5e76","repo":"kubernetes/kops","slug":"listing-keysets-v-b52971","errorCode":null,"errorMessage":"listing keysets: %v","messagePattern":"listing keysets: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":142,"sourceCode":"\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := promoteKeypair(ctx, out, name, \"\", keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"promoting keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reading keyset: %v\", err)\n\t} else if keyset == nil {","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L124-L160","documentation":"With --keyset all, RunPromoteKeypair lists all keysets from the keystore to promote each rotatable one; this wraps ListKeysets failing - the state store (VFS) could not be read (missing bucket, permissions, or connectivity).","triggerScenarios":"`kops promote keypair all --name <cluster>` where the keystore backend (S3/GCS/etcd/vault) fails while enumerating keyset directories/entries.","commonSituations":"State store bucket permissions revoked mid-run; Vault agent down when using the Vault keystore; transient network errors to the storage backend; throttling by the cloud provider.","solutions":["Retry the command — listing may have hit a transient error","Check state store permissions and connectivity (aws s3 ls <bucket>/... )","If using Vault keystore, ensure the Vault agent/address is healthy","Fall back to promoting keysets individually (kubernetes-ca, apiserver-aggregator-ca) to isolate the failing one"],"exampleFix":"// before\nkops promote keypair all --name c   # fails on listing\n// after\nkops promote keypair kubernetes-ca --name c\nkops promote keypair apiserver-aggregator-ca --name c","handlingStrategy":"retry","validationCode":"aws s3 ls \"$KOPS_STATE_STORE/cluster/$CLUSTER/keyset/\" >/dev/null || { echo \"state store keyset path not readable\"; exit 1; }","typeGuard":null,"tryCatchPattern":"for i in 1 2 3; do\n  kops promote keypair all --name \"$CLUSTER\" && break\n  sleep $((i * 5))\ndone","preventionTips":["Retry transient storage errors with backoff","Check backend health (Vault agent, S3/GCS status) for `all` promotions","Promote keysets individually to isolate a failing backend"],"tags":["cli","keystore","list","state-store"],"backgroundTag":"keystore-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}