{"record":{"id":"d46618776950d502","repo":"kubernetes/kops","slug":"unable-to-get-cluster-keystore-v","errorCode":null,"errorMessage":"unable to get cluster keystore: %v","messagePattern":"unable to get cluster keystore: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/helpers/kubectl_auth.go","lineNumber":245,"sourceCode":"\nfunc buildCredentials(ctx context.Context, f *util.Factory, options *HelperKubectlAuthOptions) (*ExecCredentialStatus, error) {\n\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tcluster, err := clientset.GetCluster(ctx, options.ClusterName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif cluster == nil {\n\t\treturn nil, fmt.Errorf(\"cluster not found %q\", options.ClusterName)\n\t}\n\n\tkeyStore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to get cluster keystore: %v\", err)\n\t}\n\n\tcn := \"kubecfg\"\n\tuser, err := user.Current()\n\tif err != nil || user == nil {\n\t\tklog.Infof(\"unable to get user: %v\", err)\n\t} else {\n\t\tcn += \"-\" + user.Name\n\t}\n\n\treq := pki.IssueCertRequest{\n\t\tSigner: fi.CertificateIDCA,\n\t\tType:   \"client\",\n\t\tSubject: pkix.Name{\n\t\t\tCommonName: cn,\n\n\t\t\tOrganization: []string{rbac.SystemPrivilegedGroup},\n\t\t},","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/helpers/kubectl_auth.go#L227-L263","documentation":"After finding the cluster, buildCredentials calls clientset.KeyStore(cluster) to get the key store backing cluster secrets (where the kOps CA lives). An error here is wrapped as 'unable to get cluster keystore'. This indicates the state-store backend couldn't be initialized or the cluster's config is unreadable, not that credentials are wrong.","triggerScenarios":"clientset.KeyStore(cluster) fails: state store backend inaccessible (S3/GCS credentials missing or expired), state store configuration invalid for the cluster object, or unsupported/legacy keyStore configuration in the cluster manifest.","commonSituations":"Expired or absent AWS credentials / AWS_PROFILE mismatch; VFS permissions on the S3 bucket; KOPS_STATE_STORE misconfigured or migrated; corrupted cluster manifest missing secret configuration.","solutions":["Check cloud credentials: run `kops get cluster <name>` to confirm state-store access works.","Verify KOPS_STATE_STORE and region/profile env vars (AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, etc.).","Inspect the cluster manifest in the state store for a missing/invalid keyStore (kops uses the default keyStore unless configured otherwise); re-export or repair the cluster config."],"exampleFix":"// before\n$ kops helpers kubectl-auth --cluster c  # no AWS creds\n// after\n$ export AWS_PROFILE=prod\n$ kops helpers kubectl-auth --cluster c","handlingStrategy":"try-catch","validationCode":"// confirm state-store access before invoking the helper\nif err := exec.Command(\"kops\", \"get\", \"cluster\", clusterName).Run(); err != nil {\n    return fmt.Errorf(\"state store unreachable or misconfigured: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := helpers.RunKubectlAuthHelper(ctx, f, out, options)\nif err != nil && strings.Contains(err.Error(), \"unable to get cluster keystore\") {\n    // refresh cloud credentials and retry once\n    if refreshCloudCredentials() == nil {\n        err = helpers.RunKubectlAuthHelper(ctx, f, out, options)\n    }\n}","preventionTips":["Keep cloud credentials (AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, etc.) fresh in automation contexts.","Test state-store access with a cheap `kops get` command before credential flows.","Avoid migrating KOPS_STATE_STORE without updating all kubeconfig-consuming hosts."],"tags":["state-store","keystore","cloud-credentials"],"backgroundTag":"state-store-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}