kubernetes/kops · error

distrusting keypair for %s: %v

Error message

distrusting keypair for %s: %v

What it means

While iterating keysets for 'all' mode, RunDistrustKeypair wraps a per-keyset distrustKeypair failure with the keyset name. The underlying failure (find, store, or validation of that keyset) is in the wrapped error.

Source

Thrown at cmd/kops/distrust_keypair.go:139

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	if options.Keyset != "all" {
		return distrustKeypair(ctx, out, options.Keyset, options.KeypairIDs, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := distrustKeypair(ctx, out, name, nil, keyStore); err != nil {
				return fmt.Errorf("distrusting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func distrustKeypair(ctx context.Context, out io.Writer, name string, keypairIDs []string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return err
	} else if keyset == nil {
		return fmt.Errorf("keyset not found")
	}

	if len(keypairIDs) == 0 {
		primarySerial := keyset.Primary.Certificate.Certificate.SerialNumber
		for id, item := range keyset.Items {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error to see which step failed for the named keyset
2. Fix the keyset-specific issue (e.g. primary-keypair constraint or store error)
3. Re-run targeting only the failing keyset by name

When it happens

Trigger: Thrown at cmd/kops/distrust_keypair.go:139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e0e0caf63c1087d8. Report an issue: GitHub.