{"record":{"id":"e2fba5930f1192f0","repo":"kubernetes/kops","slug":"error-listing-keysets-v","errorCode":null,"errorMessage":"error listing Keysets: %v","messagePattern":"error listing Keysets: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_keypairs.go","lineNumber":107,"sourceCode":"\tID                string     `json:\"id\"`\n\tDistrustTimestamp *time.Time `json:\"distrustTimestamp,omitempty\"`\n\tIsPrimary         bool       `json:\"isPrimary,omitempty\"`\n\tSubject           string     `json:\"subject,omitempty\"`\n\tIssuer            string     `json:\"issuer,omitempty\"`\n\tAlternateNames    []string   `json:\"alternateNames,omitempty\"`\n\tIsCA              bool       `json:\"isCA,omitempty\"`\n\tNotBefore         *time.Time `json:\"notBefore,omitempty\"`\n\tNotAfter          *time.Time `json:\"notAfter,omitempty\"`\n\tKeyLength         *int       `json:\"keyLength,omitempty\"`\n\tHasPrivateKey     bool       `json:\"hasPrivateKey,omitempty\"`\n}\n\nfunc listKeypairs(keyStore fi.CAStore, names []string, includeDistrusted bool) ([]*keypairItem, error) {\n\tvar items []*keypairItem\n\n\tl, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing Keysets: %v\", err)\n\t}\n\n\tfor name, keyset := range l {\n\t\tif len(names) != 0 {\n\t\t\tfound := false\n\t\t\tfor _, n := range names {\n\t\t\t\tif n == name {\n\t\t\t\t\tfound = true\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !found {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\tfor _, item := range keyset.Items {\n\t\t\tif includeDistrusted || (item.DistrustTimestamp == nil && item.Certificate != nil) {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_keypairs.go#L89-L125","documentation":"listKeypairs calls keyStore.ListKeysets() on the cluster's CAStore to enumerate all keysets. If the underlying key store (VFS-backed state store) fails to list — bad state-store path, credentials problem, network error to the backend — the error is wrapped as \"error listing Keysets: %v\". The root cause is always in the wrapped error.","triggerScenarios":"`kops get keypairs ...` where the CAStore's ListKeysets() fails: unreachable/misconfigured --state (e.g. s3://bucket), expired cloud credentials, missing bucket permissions, or a corrupted keyset layout in the state store.","commonSituations":"AWS credentials expired in CI; wrong KOPS_STATE_STORE value (typo'd bucket or wrong region); state store bucket deleted or permissions changed; network egress blocked to S3/GCS/DO spaces.","solutions":["Read the wrapped cause after the colon and fix that underlying storage error first.","Verify KOPS_STATE_STORE / --state points at an existing, accessible bucket and that cloud credentials are valid (e.g. `aws s3 ls $KOPS_STATE_STORE`).","Confirm the cluster exists: `kops get clusters`; use the exact cluster name with --name.","Retry after restoring network access or IAM permissions (s3:ListBucket / s3:GetObject on the state path)."],"exampleFix":"// before\nkops get keypairs --name c1.example.com   # wrong state store\n// after\nexport KOPS_STATE_STORE=s3://my-real-kops-state\nkops get keypairs --name c1.example.com","handlingStrategy":"retry","validationCode":"# preflight: state store reachable and credentials valid\naws s3 ls \"$KOPS_STATE_STORE\" >/dev/null 2>&1 || { echo \"state store unreachable: $KOPS_STATE_STORE\" >&2; exit 2; }","typeGuard":null,"tryCatchPattern":"if err := runKops(\"get\", \"keypairs\", \"--name\", cluster); err != nil {\n\tif strings.Contains(err.Error(), \"error listing Keysets\") {\n\t\t// inspect wrapped cause; retry with backoff for transient network/credential errors\n\t}\n\treturn err\n}","preventionTips":["Verify KOPS_STATE_STORE and cloud credentials before key operations.","Grant s3:ListBucket/s3:GetObject (or GCS equivalent) on the state path.","Retry with backoff for transient network errors against the storage backend.","Keep kOps CLI version compatible with the state store's data format."],"tags":["keystore","state-store","io","cloud-storage"],"backgroundTag":"state-store-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}