{"record":{"id":"d261feb98a74bf23","repo":"kubernetes/kops","slug":"keyset-not-found-d261fe","errorCode":null,"errorMessage":"keyset not found","messagePattern":"keyset not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":161,"sourceCode":"\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := promoteKeypair(ctx, out, name, \"\", keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"promoting keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reading keyset: %v\", err)\n\t} else if keyset == nil {\n\t\treturn fmt.Errorf(\"keyset not found\")\n\t}\n\n\tif keypairID == \"\" {\n\t\thighestCandidateId := big.NewInt(0)\n\t\tfor id, item := range keyset.Items {\n\t\t\tif item.PrivateKey != nil && item.DistrustTimestamp == nil && item.Certificate != nil {\n\t\t\t\titemId, ok := big.NewInt(0).SetString(id, 10)\n\t\t\t\tif ok && highestCandidateId.Cmp(itemId) < 0 {\n\t\t\t\t\thighestCandidateId = itemId\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tkeypairID = highestCandidateId.String()\n\t\tif keypairID == keyset.Primary.Id {\n\t\t\tfmt.Fprintf(out, \"No %s keypair newer than current primary %s\\n\", name, keypairID)\n\t\t\treturn nil\n\t\t}","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L143-L179","documentation":"FindKeyset returned success but a nil keyset, meaning no keyset exists under the given name in the cluster's key store. kOps promotes only rotatable keysets (kubernetes-ca, kubernetes-front-proxy-ca, service-account, etc.); requesting a nonexistent or non-rotatable name yields \"keyset not found\".","triggerScenarios":"`kops promote keypair <name>` where <name> does not exist in the keystore — a misspelled keyset name, a non-rotatable keyset (already rejected earlier with a different message, so typically a typo), or a keyset never created for this cluster (e.g. service-account missing in very old clusters).","commonSituations":"Typo in keyset name (e.g. `kube-ca` instead of `kubernetes-ca`); running against a cluster created before a keyset existed; operating on the wrong cluster/state store where the keyset was never issued.","solutions":["List available keysets with `kops get keypairs --name <cluster>` and use an exact name.","Fix the keyset spelling — valid rotatable names include kubernetes-ca, kubernetes-front-proxy-ca, service-account, apiserver-aggregator-ca, etcd-clients-ca, etc.","Confirm you are pointed at the intended cluster/state store.","If the keyset genuinely should exist, create/issue it first (`kops create keypair <name>`) before promoting."],"exampleFix":"// before\nkops promote keypair kube-ca --name c.example.com\n// error: keyset not found\n// after: check exact names, then run\nkops get keypairs --name c.example.com\nkops promote keypair kubernetes-ca --name c.example.com","handlingStrategy":"validation","validationCode":"// shell: verify the keyset exists before attempting promotion\nKEYSETS=$(kops get keypairs --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\" -o yaml)\necho \"$KEYSETS\" | grep -q \"name: $KEYSET$\" || \\\n  { echo \"keyset '$KEYSET' not found; valid names:\"; echo \"$KEYSETS\" | grep '^ *name:'; exit 1; }","typeGuard":null,"tryCatchPattern":"if ! kops promote keypair \"$KEYSET\" --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\" 2>&1 | grep -q 'keyset not found'; then\n  kops promote keypair \"$KEYSET\" --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\"\nelse\n  echo \"'$KEYSET' does not exist in this cluster — check spelling via: kops get keypairs\"\nfi","preventionTips":["Use shell/tab completion for keyset names instead of typing them from memory.","Copy keyset names from `kops get keypairs` output rather than docs or scripts for other clusters.","Confirm --name/--state point at the intended cluster before promoting.","Remember older clusters may lack newer keysets (e.g. service-account); create them if needed."],"tags":["keyset","not-found","cli","validation"],"backgroundTag":"resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}