{"record":{"id":"e3069d2add37c154","repo":"kubernetes/kops","slug":"error-building-key-store-path-v","errorCode":null,"errorMessage":"error building key store path: %v","messagePattern":"error building key store path: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":235,"sourceCode":"\t\tklog.Infof(\"Building SecretStore at %q\", nodeupConfig.ConfigStore.Secrets)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building secret store path: %v\", err)\n\t\t}\n\n\t\tsecretStore = secrets.NewVFSSecretStoreReader(p)\n\t\tmodelContext.SecretStore = secretStore\n\tdefault:\n\t\treturn fmt.Errorf(\"SecretStore not set\")\n\t}\n\n\tif nodeConfig != nil {\n\t\tmodelContext.KeyStore = configserver.NewKeyStore()\n\t} else if nodeupConfig.ConfigStore.Keypairs != \"\" {\n\t\tklog.Infof(\"Building KeyStore at %q\", nodeupConfig.ConfigStore.Keypairs)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building key store path: %v\", err)\n\t\t}\n\n\t\tmodelContext.KeyStore = fi.NewVFSKeystoreReader(p)\n\t\tkeyStore = modelContext.KeyStore\n\t} else {\n\t\treturn fmt.Errorf(\"KeyStore not set\")\n\t}\n\n\tif err := modelContext.Init(); err != nil {\n\t\treturn err\n\t}\n\n\tswitch bootConfig.CloudProvider {\n\tcase api.CloudProviderAWS:\n\t\tinstanceIDBytes, err := vfs.Context.ReadFile(\"metadata://aws/meta-data/instance-id\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading instance-id from AWS metadata: %v\", err)\n\t\t}","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L217-L253","documentation":"In VFS mode, nodeup builds the KeyStore (certificate/keypair reader) from nodeupConfig.ConfigStore.Keypairs via vfs.Context.BuildVfsPath and wraps it in fi.NewVFSKeystoreReader. This error means the keypairs location string is not a valid/constructible VFS path (bad scheme or malformed URL), so nodeup cannot access cluster PKI material and Run aborts.","triggerScenarios":"Running NodeUpCommand.Run() with nodeConfig == nil, ConfigStore.Keypairs non-empty, and vfs.Context.BuildVfsPath failing on that string — typo'd or unsupported scheme (e.g. 's2://...'), malformed URI, or characters corrupted during config templating.","commonSituations":"Hand-edited nodeupconfig.yaml keypairs path; partial backend migration (secrets fixed to S3 but keypairs still pointing at a removed backend); templating/quoting issues when rendering config from userdata.","solutions":["Correct ConfigStore.Keypairs in the cluster spec to a valid VFS path (e.g. s3://bucket/cluster/pki) and re-run 'kops update cluster --yes'.","Match the scheme to an installed/supported VFS backend and the rest of your state store configuration.","Regenerate nodeupconfig.yaml from the cluster spec rather than editing the file in the state store by hand.","If migrating cloud providers/state stores, update secrets and keypairs paths together and validate with a dry run before rolling nodes."],"exampleFix":"// before (nodeupconfig.yaml)\nconfigStore:\n  keypairs: s2://bucket/cluster/pki\n// after\nconfigStore:\n  keypairs: s3://bucket/cluster/pki","handlingStrategy":"validation","validationCode":"// Ensure the keypairs path is a parseable VFS path before invoking nodeup\nif _, err := vfs.Context.BuildVfsPath(cfg.ConfigStore.Keypairs); err != nil {\n    return fmt.Errorf(\"invalid ConfigStore.Keypairs path %q: %w\", cfg.ConfigStore.Keypairs, err)\n}","typeGuard":null,"tryCatchPattern":"err := cmd.Run(out)\nif err != nil && strings.Contains(err.Error(), \"error building key store path\") {\n    // fix the keypairs URI in the cluster spec and re-apply\n}","preventionTips":["Set secrets and keypairs paths together and consistently in the cluster spec","Regenerate config via kOps rather than editing state-store YAML by hand","Dry-run ('kops update cluster') and inspect the generated nodeupconfig.yaml before node replacement"],"tags":["nodeup","vfs","keystore","path-parsing"],"backgroundTag":"invalid-vfs-path","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}