kubernetes/kops · error

did not find keyset %q

Error message

did not find keyset %q

What it means

FindKeyset conventionally returns (nil, nil) when the keyset does not exist; GetBootstrapData converts that into 'did not find keyset %q'. This is distinct from 1014: the store is reachable, but no such keypair has ever been created for this cluster/instance group.

Source

Thrown at pkg/commands/toolbox_enroll.go:826

		return nil, err
	}

	keysets := make(map[string]*fi.Keyset)

	keystore, err := clientset.KeyStore(cluster)
	if err != nil {
		return nil, err
	}

	keyNames := model.KeypairNamesForInstanceGroup(cluster, ig)
	for _, keyName := range keyNames {
		keyset, err := keystore.FindKeyset(ctx, keyName)
		if err != nil {
			return nil, fmt.Errorf("getting keyset %q: %w", keyName, err)
		}

		if keyset == nil {
			return nil, fmt.Errorf("did not find keyset %q", keyName)
		}

		keysets[keyName] = keyset
	}

	nodeupConfig, bootConfig, err := configBuilder.BuildConfig(ig, wellKnownAddresses, keysets)
	if err != nil {
		return nil, err
	}

	var nodeupScript resources.NodeUpScript
	nodeupScript.NodeUpAssets = nodeUpAssets.NodeUpAssets
	nodeupScript.BootConfig = bootConfig

	nodeupScript.WithEnvironmentVariables(cluster, ig)
	nodeupScript.WithProxyEnv(cluster)
	nodeupScript.WithSysctls()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops update cluster` / `kops toolbox pki` (or `kops create keypair`) to generate the missing keyset.
2. Compare keyNames from KeypairNamesForInstanceGroup with objects under the state store pki/keysets prefix.
3. Restore the deleted keyset from a state-store backup.
4. Use a kops version consistent with the cluster so expected keyset names match.

Example fix

// before
// cluster missing "service-account" keyset -> kops toolbox enroll fails
// after
kops create keypair <cluster> service-account && kops update cluster --yes

// List expected keysets and compare with what exists before enrollment
for _, keyName := range model.KeypairNamesForInstanceGroup(cluster, ig) {
	if _, err := os.Stat(filepath.Join(stateStoreLocal, "pki", "keysets", keyName)); os.IsNotExist(err) {
		return fmt.Errorf("keyset %q missing; run kops create keypair %s %s", keyName, clusterName, keyName)
	}
}

if keyset == nil {
	return fmt.Errorf("keyset %q missing; create it with 'kops create keypair' or restore from backup", keyName)
}

When it happens

Trigger: model.KeypairNamesForInstanceGroup(cluster, ig) lists a key name (e.g. apiserver, kubernetes-ca, service-account) that is absent from the keyset store — typically a newly named keyset on an older cluster, or enrollment against a cluster whose pki data was pruned.

Common situations: Upgrading an old cluster that lacks newer keysets (e.g. service-account or etcd-manager keysets); enrolling an instance group whose required keypair name was introduced after the cluster was created; manually deleted pki/ objects in the state store.

Related errors

• getting keyset %q: %w
• error loading NodeupConfig %q: %v
• error querying cluster %q: %v
• adding keypair to %q is not supported
• error getting cluster: %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cef3136aef9c975c. Report an issue: GitHub.