{"record":{"id":"d58a53b4d294be68","repo":"kubernetes/kops","slug":"getting-keystore-v","errorCode":null,"errorMessage":"getting keystore: %v","messagePattern":"getting keystore: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":133,"sourceCode":"// RunPromoteKeypair promotes a keypair.\nfunc RunPromoteKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *PromoteKeypairOptions) error {\n\tif !rotatableKeysetFilter(options.Keyset, nil) {\n\t\treturn fmt.Errorf(\"promoting keypairs for %q is not supported\", options.Keyset)\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting cluster: %q: %v\", options.ClusterName, err)\n\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := promoteKeypair(ctx, out, name, \"\", keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"promoting keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L115-L151","documentation":"With a cluster and clientset in hand, RunPromoteKeypair calls clientSet.KeyStore(cluster) to build a keystore backed by the cluster's key store configuration. Failure is wrapped as \"getting keystore\".","triggerScenarios":"`kops promote keypair` against a cluster whose keyStore configuration in the spec is invalid or unsupported, or an internal error creating the keystore for the cluster's storage backend.","commonSituations":"Cluster spec with a malformed/unsupported keyStore field (e.g. pointing at an unsupported vault backend); partial migration of cluster spec between kOps versions; corrupted state-store entry.","solutions":["Inspect the cluster spec: `kops get cluster <name> -o yaml` and check keyStore settings","Upgrade/align kOps client version with the cluster version","Repair or remove an unsupported keyStore backend configuration and rely on the default file-based keystore","Look at the inner %v error for the backend-specific cause"],"exampleFix":"// before (cluster.yaml)\n// keyStore: {vault: {agentAddress: \"http://127.0.0.1:8200\"}}  # unsupported/agent not running\n// after\n// keyStore: {}  (use default) then kops replace -f cluster.yaml","handlingStrategy":"try-catch","validationCode":"kops get cluster \"$CLUSTER\" -o yaml | grep -A2 keyStore || true  # confirm no unsupported keyStore backend","typeGuard":null,"tryCatchPattern":"if err := RunPromoteKeypair(ctx, f, out, opts); err != nil {\n\tif strings.Contains(err.Error(), \"getting keystore\") {\n\t\tlog.Printf(\"inspect cluster keyStore spec: %v\", err)\n\t}\n}","preventionTips":["Avoid experimental keyStore backends unless supported by your kOps version","Keep kOps client and cluster versions aligned","Validate cluster spec changes with `kops replace --dry-run`"],"tags":["cli","keystore","cluster-spec"],"backgroundTag":"keystore-initialization-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}