kubernetes/kops · error

error building key store path: %v

Error message

error building key store path: %v

What it means

In VFS mode, nodeup builds the KeyStore (certificate/keypair reader) from nodeupConfig.ConfigStore.Keypairs via vfs.Context.BuildVfsPath and wraps it in fi.NewVFSKeystoreReader. This error means the keypairs location string is not a valid/constructible VFS path (bad scheme or malformed URL), so nodeup cannot access cluster PKI material and Run aborts.

Source

Thrown at upup/pkg/fi/nodeup/command.go:235

		klog.Infof("Building SecretStore at %q", nodeupConfig.ConfigStore.Secrets)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)
		if err != nil {
			return fmt.Errorf("error building secret store path: %v", err)
		}

		secretStore = secrets.NewVFSSecretStoreReader(p)
		modelContext.SecretStore = secretStore
	default:
		return fmt.Errorf("SecretStore not set")
	}

	if nodeConfig != nil {
		modelContext.KeyStore = configserver.NewKeyStore()
	} else if nodeupConfig.ConfigStore.Keypairs != "" {
		klog.Infof("Building KeyStore at %q", nodeupConfig.ConfigStore.Keypairs)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)
		if err != nil {
			return fmt.Errorf("error building key store path: %v", err)
		}

		modelContext.KeyStore = fi.NewVFSKeystoreReader(p)
		keyStore = modelContext.KeyStore
	} else {
		return fmt.Errorf("KeyStore not set")
	}

	if err := modelContext.Init(); err != nil {
		return err
	}

	switch bootConfig.CloudProvider {
	case api.CloudProviderAWS:
		instanceIDBytes, err := vfs.Context.ReadFile("metadata://aws/meta-data/instance-id")
		if err != nil {
			return fmt.Errorf("error reading instance-id from AWS metadata: %v", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct ConfigStore.Keypairs in the cluster spec to a valid VFS path (e.g. s3://bucket/cluster/pki) and re-run 'kops update cluster --yes'.
2. Match the scheme to an installed/supported VFS backend and the rest of your state store configuration.
3. Regenerate nodeupconfig.yaml from the cluster spec rather than editing the file in the state store by hand.
4. If migrating cloud providers/state stores, update secrets and keypairs paths together and validate with a dry run before rolling nodes.

Example fix

// before (nodeupconfig.yaml)
configStore:
  keypairs: s2://bucket/cluster/pki
// after
configStore:
  keypairs: s3://bucket/cluster/pki

// Ensure the keypairs path is a parseable VFS path before invoking nodeup
if _, err := vfs.Context.BuildVfsPath(cfg.ConfigStore.Keypairs); err != nil {
    return fmt.Errorf("invalid ConfigStore.Keypairs path %q: %w", cfg.ConfigStore.Keypairs, err)
}

err := cmd.Run(out)
if err != nil && strings.Contains(err.Error(), "error building key store path") {
    // fix the keypairs URI in the cluster spec and re-apply
}

When it happens

Trigger: Running NodeUpCommand.Run() with nodeConfig == nil, ConfigStore.Keypairs non-empty, and vfs.Context.BuildVfsPath failing on that string — typo'd or unsupported scheme (e.g. 's2://...'), malformed URI, or characters corrupted during config templating.

Common situations: Hand-edited nodeupconfig.yaml keypairs path; partial backend migration (secrets fixed to S3 but keypairs still pointing at a removed backend); templating/quoting issues when rendering config from userdata.

Related errors

• error building secret store path: %v
• reading keyset for %s: %v
• server-side client does not support MirrorTo
• parsing path for kops-channels manifest %s: %w
• reading kops-channels manifest %s: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e3069d2add37c154. Report an issue: GitHub.