{"record":{"id":"e991f726f342c3c7","repo":"kubernetes/kops","slug":"keyset-q-not-found-e991f7","errorCode":null,"errorMessage":"keyset %q not found","messagePattern":"keyset %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":397,"sourceCode":"\tif !filepath.IsAbs(p) {\n\t\tp = filepath.Join(c.PathSrvKubernetes(), p)\n\t}\n\n\t// We use the keypair ID passed in nodeup.Config instead of the primary\n\t// keypair so that the node will be updated when the primary keypair does\n\t// not match the one that we are using.\n\tkeypairID := c.NodeupConfig.KeypairIDs[name]\n\tif keypairID == \"\" {\n\t\t// kOps bug where KeypairID was not populated for the node role.\n\t\treturn fmt.Errorf(\"no keypair ID for %q\", name)\n\t}\n\n\tkeyset, err := c.KeyStore.FindKeyset(ctx.Context(), name)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"keyset %q not found\", name)\n\t}\n\n\titem := keyset.Items[keypairID]\n\tif item == nil {\n\t\treturn fmt.Errorf(\"did not find keypair %s for %s\", keypairID, name)\n\t}\n\n\tif includeCert {\n\t\tcertificate := item.Certificate\n\t\tif certificate == nil {\n\t\t\treturn fmt.Errorf(\"certificate %q not found\", name)\n\t\t}\n\n\t\tcert, err := certificate.AsString()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L379-L415","documentation":"After resolving the keypair ID, buildCertificatePairTask calls KeyStore.FindKeyset to load the named keyset from the state store. A nil result (not an error) means no keyset with that name exists in the keystore, so nodeup cannot write the certificate/key files.","triggerScenarios":"FindKeyset(ctx, name) returns nil for a keyset name passed to BuildCertificatePairTask/BuildPrivateKeyTask/Build — the keyset is absent from the state store (e.g. the VFS backend) or the name is misspelled by the model builder.","commonSituations":"State store corrupted or partially deleted (`s3://.../secrets/` keys removed); building a custom model referencing a keyset name that was never created; cluster recreated with a new state store but nodes pointing at the old one.","solutions":["List keysets with `kops get keypairs` and recreate the missing one: `kops create keypair <name>`","Verify the state store location on the node config matches the real cluster state store (KOPS_STATE_STORE)","Restore the deleted keyset from a state-store backup (S3 versioning / snapshot)","Fix the model builder/builder code if a custom patch passes an incorrect keyset name"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"keyset, err := keyStore.FindKeyset(ctx, name)\nif err != nil { return err }\nif keyset == nil { return fmt.Errorf(\"keyset %q missing from state store; run 'kops create keypair %s'\", name, name) }","typeGuard":null,"tryCatchPattern":"if err := c.BuildCertificatePairTask(ctx, name, path, filename, owner, nil); err != nil {\n    if strings.Contains(err.Error(), \"keyset\") && strings.Contains(err.Error(), \"not found\") {\n        // recreate keyset in state store then retry\n    }\n    return err\n}","preventionTips":["Enable versioning/backup on the state store bucket","Audit keysets with `kops get keypairs` before node rolls","Never manually delete objects under secrets/ in the state store","Use a single authoritative KOPS_STATE_STORE per cluster"],"tags":["go","nodeup","keystore","state-store"],"backgroundTag":"keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}