{"record":{"id":"deb70114c153a3ca","repo":"kubernetes/kops","slug":"keystore-not-set","errorCode":null,"errorMessage":"KeyStore not set","messagePattern":"KeyStore not set","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":241,"sourceCode":"\t\tsecretStore = secrets.NewVFSSecretStoreReader(p)\n\t\tmodelContext.SecretStore = secretStore\n\tdefault:\n\t\treturn fmt.Errorf(\"SecretStore not set\")\n\t}\n\n\tif nodeConfig != nil {\n\t\tmodelContext.KeyStore = configserver.NewKeyStore()\n\t} else if nodeupConfig.ConfigStore.Keypairs != \"\" {\n\t\tklog.Infof(\"Building KeyStore at %q\", nodeupConfig.ConfigStore.Keypairs)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building key store path: %v\", err)\n\t\t}\n\n\t\tmodelContext.KeyStore = fi.NewVFSKeystoreReader(p)\n\t\tkeyStore = modelContext.KeyStore\n\t} else {\n\t\treturn fmt.Errorf(\"KeyStore not set\")\n\t}\n\n\tif err := modelContext.Init(); err != nil {\n\t\treturn err\n\t}\n\n\tswitch bootConfig.CloudProvider {\n\tcase api.CloudProviderAWS:\n\t\tinstanceIDBytes, err := vfs.Context.ReadFile(\"metadata://aws/meta-data/instance-id\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading instance-id from AWS metadata: %v\", err)\n\t\t}\n\t\tmodelContext.InstanceID = string(instanceIDBytes)\n\n\t\t// Check if WarmPool is enabled first, to avoid additional API calls\n\t\tif len(modelContext.NodeupConfig.WarmPoolImages) > 0 {\n\t\t\tmodelContext.ConfigurationMode, err = getAWSConfigurationMode(ctx, modelContext)\n\t\t\tif err != nil {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L223-L259","documentation":"nodeup needs a KeyStore to read cluster CA-signed certificates and keys (kubelet client/server certs). With no config-server NodeConfig, it requires nodeupConfig.ConfigStore.Keypairs to be set; when ConfigStore is nil or Keypairs is empty, Run returns this error at the switch's else branch. Provisioning cannot proceed without access to the cluster PKI.","triggerScenarios":"Running NodeUpCommand.Run() in VFS mode where nodeupConfig.ConfigStore is nil or ConfigStore.Keypairs == \"\" and nodeConfig == nil — the parsed nodeupconfig.yaml has no configStore.keypairs field.","commonSituations":"State store configs from an older kOps version missing the keypairs field; nodeupconfig.yaml that was hand-trimmed or partially corrupted; config generated for config-server mode but the node boots via VFS without ConfigServer set.","solutions":["Re-run 'kops update cluster --yes' with a current kOps version to regenerate nodeupconfig.yaml including configStore.keypairs.","Set configStore.keypairs (e.g. s3://bucket/cluster/pki) in the cluster spec and re-apply the update.","If you intend config-server mode, configure bootConfig.ConfigServer.Servers so the nodeConfig branch is taken instead.","Verify the pki directory actually exists in the state store and contains the cluster CA keypairs (kops get secrets / inspect the bucket)."],"exampleFix":"// before (nodeupconfig.yaml)\nconfigStore:\n  secrets: s3://bucket/cluster/secrets\n// after\nconfigStore:\n  secrets: s3://bucket/cluster/secrets\n  keypairs: s3://bucket/cluster/pki","handlingStrategy":"validation","validationCode":"// Require a key store source before invoking nodeup\nif nodeConfig == nil && (cfg.ConfigStore == nil || cfg.ConfigStore.Keypairs == \"\") {\n    return fmt.Errorf(\"configStore.keypairs must be set (or use ConfigServer mode)\")\n}","typeGuard":null,"tryCatchPattern":"err := cmd.Run(out)\nif err != nil && strings.Contains(err.Error(), \"KeyStore not set\") {\n    // regenerate nodeupconfig.yaml via kops update cluster and verify pki exists\n}","preventionTips":["Run 'kops update cluster --yes' after kOps upgrades so configStore.keypairs is populated","Confirm the pki path exists in the state store with valid CA keypairs before rolling nodes","Pick one mode (config-server vs VFS) and configure the boot config accordingly"],"tags":["nodeup","keystore","missing-config","pki"],"backgroundTag":"missing-required-config-field","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}