{"record":{"id":"cdda8da6205cff4d","repo":"kubernetes/kops","slug":"keyset-q-not-found-cdda8d","errorCode":null,"errorMessage":"keyset %q not found","messagePattern":"keyset %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/discovery_service.go","lineNumber":116,"sourceCode":"\treturn nil\n}\n\nfunc findJWKSForServiceAccount(ctx context.Context, keypairIDs map[string]string, keystore fi.KeystoreReader) ([]nodetasks.JSONWebKey, error) {\n\tvar jwks []nodetasks.JSONWebKey\n\n\tname := \"service-account\"\n\tkeypairID := keypairIDs[name]\n\tif keypairID == \"\" {\n\t\t// kOps bug where KeypairID was not populated for the node role.\n\t\treturn nil, fmt.Errorf(\"no keypair ID for %q\", name)\n\t}\n\n\tkeyset, err := keystore.FindKeyset(ctx, name)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif keyset == nil {\n\t\treturn nil, fmt.Errorf(\"keyset %q not found\", name)\n\t}\n\n\tfor _, item := range keyset.Items {\n\t\tif item.DistrustTimestamp != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif item.Certificate == nil || item.Certificate.Subject.CommonName != \"service-account\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tpublicKey := item.Certificate.PublicKey\n\n\t\tjwk := nodetasks.JSONWebKey{}\n\n\t\t{\n\t\t\tjwk.KeyID = item.Id\n\t\t\t// publicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)\n\t\t\t// if err != nil {","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/discovery_service.go#L98-L134","documentation":"After confirming the keypair ID exists, findJWKSForServiceAccount reads the 'service-account' keyset from the cluster keystore. If FindKeyset returns nil (keyset absent from state store) rather than an error, this explicit error is returned because no JWKS can be built without the signing keys.","triggerScenarios":"keystore.FindKeyset(ctx, \"service-account\") returns (nil, nil) — the service-account keyset does not exist in the cluster state store (S3/GCS/OSS bucket) even though the keypair ID map references it.","commonSituations":"Cluster state store was pruned, restored partially, or migrated losing the service-account key; keypair ID cached in nodeup config points at a key deleted from state; creating a discovery-service registration before the CA/service-account keys are ever issued.","solutions":["Check `kops get keypairs service-account` in the state store; if absent, re-create with `kops update cluster` (it issues the service-account signer)","Restore the service-account keyset from a state-store backup","Run `kops toolbox dump` / inspect the state store's pki directory to confirm the keyset exists","Re-issue cluster secrets: `kops update cluster --refresh-cluster-issue-certificates`"],"exampleFix":"# verify and re-issue missing keyset\nkops get keypairs --type secrets | grep service-account\nkops update cluster mycluster.example.com --yes --refresh-cluster-issue-certificates","handlingStrategy":"validation","validationCode":"# confirm the keyset exists in the state store before nodeup runs\nkops get keypairs service-account --type secrets || \\\n  { echo 'service-account keyset missing; run kops update cluster'; exit 1; }","typeGuard":null,"tryCatchPattern":"keyset, err := keystore.FindKeyset(ctx, \"service-account\")\nif err != nil {\n\treturn err\n}\nif keyset == nil {\n\t// re-issue the service-account signer before retrying JWKS construction\n\treturn fmt.Errorf(\"service-account keyset absent from state store; run kops update cluster --refresh-cluster-issue-certificates\")\n}","preventionTips":["Back up the kOps state store (S3/GCS bucket) including the pki directory","Never manually delete keysets from state; use `kops delete keypair` workflows","After state-store restore/migration, verify all keysets with `kops get keypairs`","Issue cluster secrets with `kops update cluster` before enabling the discovery service"],"tags":["keystore","keyset","service-account","discovery-service","state-store"],"backgroundTag":"missing-keypair-id","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}