{"record":{"id":"cef3136aef9c975c","repo":"kubernetes/kops","slug":"did-not-find-keyset-q","errorCode":null,"errorMessage":"did not find keyset %q","messagePattern":"did not find keyset %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":826,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tkeysets := make(map[string]*fi.Keyset)\n\n\tkeystore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeyNames := model.KeypairNamesForInstanceGroup(cluster, ig)\n\tfor _, keyName := range keyNames {\n\t\tkeyset, err := keystore.FindKeyset(ctx, keyName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"getting keyset %q: %w\", keyName, err)\n\t\t}\n\n\t\tif keyset == nil {\n\t\t\treturn nil, fmt.Errorf(\"did not find keyset %q\", keyName)\n\t\t}\n\n\t\tkeysets[keyName] = keyset\n\t}\n\n\tnodeupConfig, bootConfig, err := configBuilder.BuildConfig(ig, wellKnownAddresses, keysets)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar nodeupScript resources.NodeUpScript\n\tnodeupScript.NodeUpAssets = nodeUpAssets.NodeUpAssets\n\tnodeupScript.BootConfig = bootConfig\n\n\tnodeupScript.WithEnvironmentVariables(cluster, ig)\n\tnodeupScript.WithProxyEnv(cluster)\n\tnodeupScript.WithSysctls()\n","sourceCodeStart":808,"sourceCodeEnd":844,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L808-L844","documentation":"FindKeyset conventionally returns (nil, nil) when the keyset does not exist; GetBootstrapData converts that into 'did not find keyset %q'. This is distinct from 1014: the store is reachable, but no such keypair has ever been created for this cluster/instance group.","triggerScenarios":"model.KeypairNamesForInstanceGroup(cluster, ig) lists a key name (e.g. apiserver, kubernetes-ca, service-account) that is absent from the keyset store — typically a newly named keyset on an older cluster, or enrollment against a cluster whose pki data was pruned.","commonSituations":"Upgrading an old cluster that lacks newer keysets (e.g. service-account or etcd-manager keysets); enrolling an instance group whose required keypair name was introduced after the cluster was created; manually deleted pki/ objects in the state store.","solutions":["Run `kops update cluster` / `kops toolbox pki` (or `kops create keypair`) to generate the missing keyset.","Compare keyNames from KeypairNamesForInstanceGroup with objects under the state store pki/keysets prefix.","Restore the deleted keyset from a state-store backup.","Use a kops version consistent with the cluster so expected keyset names match."],"exampleFix":"// before\n// cluster missing \"service-account\" keyset -> kops toolbox enroll fails\n// after\nkops create keypair <cluster> service-account && kops update cluster --yes","handlingStrategy":"validation","validationCode":"// List expected keysets and compare with what exists before enrollment\nfor _, keyName := range model.KeypairNamesForInstanceGroup(cluster, ig) {\n\tif _, err := os.Stat(filepath.Join(stateStoreLocal, \"pki\", \"keysets\", keyName)); os.IsNotExist(err) {\n\t\treturn fmt.Errorf(\"keyset %q missing; run kops create keypair %s %s\", keyName, clusterName, keyName)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if keyset == nil {\n\treturn fmt.Errorf(\"keyset %q missing; create it with 'kops create keypair' or restore from backup\", keyName)\n}","preventionTips":["Run kops update cluster after upgrading kops so new keysets are created","Never manually delete objects under pki/ in the state store","Keep state-store backups for keyset recovery"],"tags":["kops","keyset","missing-keypair","state-store"],"backgroundTag":"keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}