{"record":{"id":"e014a3b0230f82d8","repo":"kubernetes/kops","slug":"failed-to-get-keyset-from-q","errorCode":null,"errorMessage":"failed to get keyset from %q","messagePattern":"failed to get keyset from %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/bootstrapscript.go","lineNumber":111,"sourceCode":"\t\t}\n\n\t\tklog.V(8).Infof(\"Resolved alternateNames %q for %q\", addresses, hasAddress)\n\n\t\tfor _, wellKnownService := range hasAddress.GetWellKnownServices() {\n\t\t\twellKnownAddresses[wellKnownService] = append(wellKnownAddresses[wellKnownService], addresses...)\n\t\t}\n\t}\n\n\tfor k := range wellKnownAddresses {\n\t\tsort.Strings(wellKnownAddresses[k])\n\t}\n\n\tkeysets := make(map[string]*fi.Keyset)\n\tfor _, caTask := range b.caTasks {\n\t\tname := *caTask.Name\n\t\tkeyset := caTask.Keyset()\n\t\tif keyset == nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get keyset from %q\", name)\n\t\t}\n\t\tkeysets[name] = keyset\n\t}\n\tconfig, bootConfig, err := b.builder.NodeUpConfigBuilder.BuildConfig(ig, wellKnownAddresses, keysets)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tconfigData, err := utils.YamlMarshal(config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error converting nodeup config to yaml: %v\", err)\n\t}\n\tsum256 := sha256.Sum256(configData)\n\tbootConfig.NodeupConfigHash = base64.StdEncoding.EncodeToString(sum256[:])\n\tb.nodeupConfig.Resource = fi.NewBytesResource(configData)\n\n\tif ig.Spec.Manager == kops.InstanceManagerKarpenter {\n\t\tassetBuilder := assets.NewAssetBuilder(vfs.NewVFSContext(), cluster.Spec.Assets, false)","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/bootstrapscript.go#L93-L129","documentation":"kubeEnv collects the cluster's CA keysets from the configured keystore tasks (b.caTasks). Each task must expose a Keyset(); if any returns nil, kubeEnv aborts because nodeup cannot be given the cluster's signing key material.","triggerScenarios":"Running `kops update cluster` when a keypair/keystore task exists in the target but its Keyset() is nil — typically when the keyset has not been created/stored yet or was deleted from the key store.","commonSituations":"Cluster state where the keyset was manually deleted from the state store; interrupted first `kops update cluster` before keysets were stored; corrupted or partially synced state store (e.g. S3/GCS bucket issues).","solutions":["Inspect the state store (s3://.../cluster/.../pki) and verify the named keyset exists; restore or recreate it.","Re-run cluster creation so the keyset task publishes its keyset before bootstrap script generation.","If state is corrupted, use `kops toolbox pki`/exported CA to regenerate keysets, or recreate the cluster from a good backup."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify keysets exist in the state store before updating\nfor _, ks := range []string{\"kubernetes-ca\", \"service-account\"} {\n  if _, err := keyStore.FindKeyset(ctx, ks); err != nil || keyset == nil {\n    return fmt.Errorf(\"keyset %q missing from state store\", ks)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never manually delete entries under the pki/ path of the state store.","Let `kops update cluster` complete its first run so keysets are published.","Back up the state store bucket before destructive operations."],"tags":["pki","keyset","bootstrap","nodeup"],"backgroundTag":"missing-keyset","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}