kubernetes/kops · error

creating keypair for %s: %v

Error message

creating keypair for %s: %v

What it means

When iterating keysets under `--keyset all`, if createKeypair fails for one rotatable keyset, the loop aborts and wraps the per-keyset error with "creating keypair for <name>". The embedded error is the real cause (e.g. an error from errors 248/249 or keystore writes).

Source

Thrown at cmd/kops/create_keypair.go:178

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return createKeypair(ctx, out, options, options.Keyset, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := createKeypair(ctx, out, options, name, keyStore); err != nil {
				return fmt.Errorf("creating keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func createKeypair(ctx context.Context, out io.Writer, options *CreateKeypairOptions, name string, keyStore fi.CAStore) error {
	var err error
	var privateKey *pki.PrivateKey
	if options.PrivateKeyPath != "" {
		options.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)
		privateKeyBytes, err := os.ReadFile(options.PrivateKeyPath)
		if err != nil {
			return fmt.Errorf("error reading user provided private key %q: %v", options.PrivateKeyPath, err)
		}

		privateKey, err = pki.ParsePEMPrivateKey(privateKeyBytes)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error to identify the failing keyset.
2. Rotate that keyset individually with --keyset <name> to debug in isolation.
3. Ensure the provided --key/--cert is compatible with all rotatable keysets, or rotate without them.
4. Re-run `--keyset all` after fixing; kOps keeps track of primary keys per keyset.

Example fix

// before
kops create keypair cluster.k8s.local --keyset all --key ./rsa.key   # fails on service-account keyset
// after
kops create keypair cluster.k8s.local --keyset ca --key ./rsa.key
kops create keypair cluster.k8s.local --keyset service-account   # generate instead

# pre-check each rotatable keyset is readable before bulk rotation
for ks in ca service-account; do
  kops get keypairs "$CLUSTER" --keyset "$ks" >/dev/null || { echo "keyset $ks unhealthy"; exit 1; }
done

if ! out=$(kops create keypair "$CLUSTER" --keyset all 2>&1); then
  ks=$(echo "$out" | sed -n 's/.*creating keypair for \([^:]*\).*/\1/p')
  echo "isolating failure in keyset: $ks"
  kops create keypair "$CLUSTER" --keyset "$ks" || exit 1
  # continue with remaining keysets individually
fi

When it happens

Trigger: `--keyset all` where any rotatable keyset's createKeypair call errors (cmd/kops/create_keypair.go:178). Note: processing stops at the first failing keyset.

Common situations: One keyset in a bad state (corrupt existing keypair) while others rotate fine; provided --key incompatible with a particular keyset's algorithm; partial rotation leaves some keysets rotated and others not.

Related errors

• cannot specify --key with "all"
• cannot specify --primary with "all"
• adding keypair to %q is not supported
• error getting keystore: %v
• error loading private key %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/346f4015f491b910. Report an issue: GitHub.