{"record":{"id":"ec76c2705670976a","repo":"kubernetes/kops","slug":"keyset-q-not-found","errorCode":null,"errorMessage":"keyset %q not found","messagePattern":"keyset %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/trust_keypair.go","lineNumber":116,"sourceCode":"\t\treturn err\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tkeyStore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tkeyset, err := keyStore.FindKeyset(ctx, options.Keyset)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif keyset == nil {\n\t\treturn fmt.Errorf(\"keyset %q not found\", options.Keyset)\n\t}\n\n\tfor _, id := range options.KeypairIDs {\n\t\titem := keyset.Items[id]\n\t\tif item == nil {\n\t\t\treturn fmt.Errorf(\"keypair not found\")\n\t\t}\n\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\titem.DistrustTimestamp = nil\n\n\t\tif err := keyStore.StoreKeyset(ctx, options.Keyset, keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error storing keypair: %w\", err)\n\t\t}\n","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/trust_keypair.go#L98-L134","documentation":"kops `trust keypair` trusts (un-distrusts) existing keypairs in a keyset. Before touching any keypair, it looks up the named keyset in the key store; if the store has no entry for it, FindKeyset returns (nil, nil) and the command aborts with `keyset %q not found`. This means the name given to --keyset (or the default keyset name) does not exist in the cluster's key store.","triggerScenarios":"Running `kops trust keypair --name <cluster> <keyset> <id>` where <keyset> is not a real keyset name (e.g. a typo like 'kubernetes-ca' instead of 'kubernetes-ca' variants such as 'ca', 'apiserver-aggregator-ca', 'service-account', 'etcd-clients-ca'), or the keyset was deleted from the backend, or the --name points at a cluster whose key store has never been populated.","commonSituations":"Typo in keyset name; running against a cluster before any keys were created; pointing at the wrong state store/cluster name so the keyset lookup hits an empty store; migrating key storage backends and expecting keys to exist in the new backend.","solutions":["List available keysets with `kops get keypairs --name <cluster>` and use an exact keyset name","Check --name / --state flags point at the intended cluster and state store","Recreate the keyset (e.g. `kops replace --force` or `kops create keypair`) if it was deleted"],"exampleFix":"// before\nkops trust keypair --name mycluster.k8s.local kubernetes-ca-cer i-abc123   # typo\n// after\nkops get keypairs --name mycluster.k8s.local   # confirm names\nkops trust keypair --name mycluster.k8s.local kubernetes-ca i-abc123","handlingStrategy":"validation","validationCode":"keysets, err := client.ListKeysets(ctx) // or: kops get keypairs --name <cluster>\nif !slices.Contains(keysets, options.Keyset) {\n\treturn fmt.Errorf(\"keyset %q does not exist; pick one from: %v\", options.Keyset, keysets)\n}\n_ = client.TrustKeypair(ctx, options)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enumerate keysets with `kops get keypairs --name <cluster>` before trusting","Verify --name and --state resolve to the intended cluster/store","Pin keyset names (ca, etcd-clients-ca, service-account, etc.) in scripts rather than free-typing"],"tags":["cli","keypairs","keystore"],"backgroundTag":"keyset-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}