{"record":{"id":"fdffe0c67a9c3770","repo":"kubernetes/kops","slug":"promoting-keypair-for-s-v","errorCode":null,"errorMessage":"promoting keypair for %s: %v","messagePattern":"promoting keypair for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":148,"sourceCode":"\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {\n\t\treturn promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)\n\t}\n\n\tkeysets, err := keyStore.ListKeysets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing keysets: %v\", err)\n\t}\n\n\tfor name := range keysets {\n\t\tif rotatableKeysetFilter(name, nil) {\n\t\t\tif err := promoteKeypair(ctx, out, name, \"\", keyStore); err != nil {\n\t\t\t\treturn fmt.Errorf(\"promoting keypair for %s: %v\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {\n\tkeyset, err := keyStore.FindKeyset(ctx, name)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reading keyset: %v\", err)\n\t} else if keyset == nil {\n\t\treturn fmt.Errorf(\"keyset not found\")\n\t}\n\n\tif keypairID == \"\" {\n\t\thighestCandidateId := big.NewInt(0)\n\t\tfor id, item := range keyset.Items {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L130-L166","documentation":"This error wraps a per-keyset failure that occurred while running `kops promote keypair all`. RunPromoteKeypair lists every keyset in the cluster's keystore and, for each rotatable keyset, calls promoteKeypair to promote its newest usable keypair. When any individual keyset promotion fails, the error is wrapped as \"promoting keypair for <keyset>: <cause>\" so the operator knows which keyset aborted the batch.","triggerScenarios":"Running `kops promote keypair all --name <cluster> ...` where at least one rotatable keyset fails inside promoteKeypair — e.g. FindKeyset returns an error (backend/state-store read failure), or the keyset lacks a promotable candidate causing a wrapped inner error. The message shown here is the outer wrapper; the %v carries the real cause (e.g. \"reading keyset: ...\").","commonSituations":"State-store (S3/GCS/etc.) connectivity or permission problems during a bulk rotation; a corrupted keyset that fails to read; interrupted rotation leaving a keyset unreadable; running the command against a cluster whose state store was migrated or partially deleted.","solutions":["Read the wrapped cause after \"promoting keypair for <name>: \" — it names the keyset and the underlying error.","Retry the command once transient state-store/network issues are resolved; already-promoted keysets simply report \"no keypair newer than current primary\".","Promote the failing keyset individually (`kops promote keypair <keyset> ...`) to isolate and debug it.","Verify state-store access (`--state` flag / KOPS_STATE_STORE) and that the cluster config is intact with `kops get cluster <name>`."],"exampleFix":"// before: run bulk promotion and get opaque failure\nkops promote keypair all --name cluster.example.com\n// after: isolate the failing keyset and check state store first\nkops get cluster cluster.example.com --state s3://my-state-store\nkops promote keypair kubernetes-ca --name cluster.example.com --state s3://my-state-store","handlingStrategy":"try-catch","validationCode":"// shell pre-check before bulk promotion\nkops get cluster \"$CLUSTER\" --state \"$KOPS_STATE_STORE\" && \\\nkops get keypairs --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\" || \\\n  { echo \"state store or keypairs unreadable; aborting promote keypair all\"; exit 1; }","typeGuard":null,"tryCatchPattern":"if ! kops promote keypair all --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\"; then\n  echo \"bulk promotion failed; inspect wrapped cause per keyset\"\n  kops get keypairs --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\"\n  # retry individual keysets to find the offender\n  for ks in kubernetes-ca kubernetes-front-proxy-ca service-account; do\n    kops promote keypair \"$ks\" --name \"$CLUSTER\" --state \"$KOPS_STATE_STORE\" || echo \"failed keyset: $ks\"\n  done\nfi","preventionTips":["Verify state-store reachability and credentials before running bulk promotion.","Prefer promoting keysets individually in automation so one bad keyset doesn't mask others.","Monitor cloud storage health/quotas during maintenance windows.","Keep cluster state backed up (versioned S3/GCS buckets) so corrupt keysets can be restored."],"tags":["keypair","rotation","keystore","cli"],"backgroundTag":"keyset-promotion-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}