{"record":{"id":"cba2313237d94012","repo":"kubernetes/kops","slug":"listing-keysets-v","errorCode":null,"errorMessage":"listing keysets: %v","messagePattern":"listing keysets: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":172,"sourceCode":"\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn createKeypair(ctx, out, options, options.Keyset, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := createKeypair(ctx, out, options, name, keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"creating keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc createKeypair(ctx context.Context, out io.Writer, options *CreateKeypairOptions, name string, keyStore fi.CAStore) error {\n\tvar err error\n\tvar privateKey *pki.PrivateKey\n\tif options.PrivateKeyPath != \"\" {\n\t\toptions.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L154-L190","documentation":"With --keyset all, RunCreateKeypair lists all keysets from the cluster keystore to rotate each rotatable one; this wraps ListKeysets failing, i.e. the state store (VFS) could not be read - missing bucket, permissions, or connectivity.","triggerScenarios":"`kops create keypair <cluster> --keyset all` where keyStore.ListKeysets() fails — usually an underlying read failure from the state store (permissions, network, corrupt objects) (cmd/kops/create_keypair.go:172).","commonSituations":"State store temporarily unavailable; IAM policy denying ListObjects/read on the store; partial/corrupt keycert data left by an interrupted rotation.","solutions":["Verify the cluster state store path and access credentials","Check the underlying storage (S3/GCS) is reachable","Run with a specific --keyset to bypass listing if only one keyset is needed"],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset all   # listing fails due to IAM\n// after\naws s3 ls s3://my-bucket/cluster.k8s.local/pki/  # verify access, fix IAM, then retry","handlingStrategy":"try-catch","validationCode":"aws s3 ls \"${KOPS_STATE_STORE}/cluster.k8s.local/pki/\" >/dev/null 2>&1 || { echo \"cannot list pki objects in state store\"; exit 1; }","typeGuard":null,"tryCatchPattern":"for i in 1 2 3; do\n  kops create keypair \"$CLUSTER\" --keyset all && break\n  sleep $((i * 5))\ndone","preventionTips":["Grant list/read IAM permissions on the entire state store prefix.","Add retry-with-backoff around bulk kOps operations in CI.","Keep state store backups so corrupt listings can be restored."],"tags":["state-store","keysets","listing","kops"],"backgroundTag":"state-store-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}