{"record":{"id":"bf8e0bbec0277dee","repo":"kubernetes/kops","slug":"keypair-not-found-bf8e0b","errorCode":null,"errorMessage":"keypair not found","messagePattern":"keypair not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":191,"sourceCode":"\t\t}\n\n\t\tkeypairID = highestCandidateId.String()\n\t\tif keypairID == keyset.Primary.Id {\n\t\t\tfmt.Fprintf(out, \"No %s keypair newer than current primary %s\\n\", name, keypairID)\n\t\t\treturn nil\n\t\t}\n\t} else if item := keyset.Items[keypairID]; item != nil {\n\t\tif item.DistrustTimestamp != nil {\n\t\t\treturn fmt.Errorf(\"keypair is distrusted\")\n\t\t}\n\t\tif item.PrivateKey == nil {\n\t\t\treturn fmt.Errorf(\"keypair has no private key\")\n\t\t}\n\t\tif item.Certificate == nil {\n\t\t\treturn fmt.Errorf(\"keypair has no certificate\")\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"keypair not found\")\n\t}\n\n\tkeyset.Primary = keyset.Items[keypairID]\n\terr = keyStore.StoreKeyset(ctx, name, keyset)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"writing keyset: %v\", err)\n\t}\n\n\tfmt.Fprintf(out, \"Promoted %s %s\\n\", name, keypairID)\n\treturn nil\n}\n\nfunc completePromoteKeyset(ctx context.Context, f commandutils.Factory, options *PromoteKeypairOptions, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\tcommandutils.ConfigureKlogForCompletion()\n\n\tcluster, clientSet, completions, directive := GetClusterForCompletion(ctx, f, nil)\n\tif cluster == nil {\n\t\treturn completions, directive","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L173-L209","documentation":"This error is returned by promoteKeypair when the keypairID supplied to `kops promote keypair` does not match any item in the named keyset. kOps looks up keyset.Items[keypairID]; if that map entry is nil it cannot promote a nonexistent keypair and fails. It protects against promoting or re-pointing the primary at an ID that simply does not exist in the store.","triggerScenarios":"Running `kops promote keypair <name> <keypairID>` with an ID that is not a key in keyset.Items — e.g. a typo in the numeric ID, referencing an ID from a different keyset (ca vs service-account), or an ID from a different cluster/state store, or referencing a keypair that was already deleted.","commonSituations":"Typo or wrong revision number when copying an ID from `kops get keypairs`; running against the wrong --name or --state so the target keyset is a different one; the keypair was deleted (or rotated away / pruned) before the promote was retried; scripting that carries stale IDs across runs.","solutions":["List the actual keypair IDs with `kops get keypairs <name>` and re-run promote with an ID that exists in that keyset.","Confirm you are targeting the right cluster and state store (--name, --state flags) so you are not looking into a different keyset.","Omit the keypairID entirely — `kops promote keypair <name>` — so kOps auto-selects the highest valid candidate (private key + certificate, not distrusted).","If the keypair was deleted, restore it from the state store backup or re-create it via rotation before promoting."],"exampleFix":"// before: ID that doesn't exist in this keyset\n// kops promote keypair ca 99   ->  \"keypair not found\"\n// after: discover real IDs first, then promote\n// kops get keypairs ca\n// kops promote keypair ca 3","handlingStrategy":"validation","validationCode":"if _, ok := keyset.Items[keypairID]; !ok {\n    return fmt.Errorf(\"keypair %s does not exist in keyset %s\", keypairID, name)\n}\n// CLI-side: `kops get keypairs <name>` and pick an ID from the output","typeGuard":"func keypairExists(keyset *fi.Keyset, id string) bool {\n\treturn keyset != nil && keyset.Items != nil && keyset.Items[id] != nil\n}","tryCatchPattern":null,"preventionTips":["Copy keypair IDs directly from `kops get keypairs <name>` output rather than typing them.","Confirm --name and --state point at the same cluster whose keypairs you listed.","Never reuse IDs across keysets (ca vs service-account) or clusters.","Handle deleted/rotated IDs in scripts: list IDs fresh on each run instead of caching them."],"tags":["keypair","keystore","cluster-administration","wrong-identifier"],"backgroundTag":"keypair-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}