kubernetes/kops · error

error getting cluster: %q: %v

Error message

error getting cluster: %q: %v

What it means

RunCreateKeypair resolves the cluster via GetCluster (which reads cluster config from the kOps state store) before touching the keystore. Any failure loading the cluster object is wrapped with this message, embedding the cluster name and underlying error.

Source

Thrown at cmd/kops/create_keypair.go:153

		},
	}

	cmd.Flags().StringVar(&options.CertPath, "cert", options.CertPath, "Path to CA certificate")
	cmd.Flags().StringVar(&options.PrivateKeyPath, "key", options.PrivateKeyPath, "Path to CA private key")
	cmd.Flags().BoolVar(&options.Primary, "primary", options.Primary, "Make the keypair the one used to issue certificates")

	return cmd
}

// RunCreateKeypair adds a custom CA certificate and private key.
func RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *CreateKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("adding keypair to %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("error getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("error getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return createKeypair(ctx, out, options, options.Keyset, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the cluster exists: `kops get clusters` with the same --state.
2. Check KOPS_STATE_STORE / --state points at the correct store and credentials allow access.
3. Confirm the exact cluster name (fully qualified, e.g. cluster.k8s.local).
4. Test state-store access directly (aws s3 ls / gsutil ls on the bucket).

Example fix

// before
KOPS_STATE_STORE=mystore kops create keypair cluster.k8s.local --keyset ca
// after
export KOPS_STATE_STORE=s3://my-correct-bucket
kops create keypair cluster.k8s.local --keyset ca

kops get cluster "$CLUSTER" >/dev/null 2>&1 || { echo "cannot resolve cluster $CLUSTER in state store"; exit 1; }
kops create keypair "$CLUSTER" --keyset ca

if ! out=$(kops create keypair "$CLUSTER" --keyset ca 2>&1); then
  case "$out" in
    *"error getting cluster"*) echo "Fix state store / cluster name: $out";;
    *) echo "Unexpected failure: $out";;
  esac
  exit 1
fi

When it happens

Trigger: `kops create keypair <cluster> ...` where GetCluster fails: cluster not found in state store, wrong --state / KOPS_STATE_STORE, malformed registry path, or connectivity/permission failure to the state backend (cmd/kops/create_keypair.go:153).

Common situations: Wrong KOPS_STATE_STORE env var (e.g. pointing at an empty bucket); cluster name typo; expired cloud credentials blocking S3/GCS access; cluster was deleted.

Related errors

• error querying cluster %q: %v
• error loading NodeupConfig %q: %v
• listing keysets: %v
• adding encryptionconfig secret: %v
• updating encryptionconfig secret: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b57a845a41d80702. Report an issue: GitHub.