kubernetes/kops · error

error getting keystore: %v

Error message

error getting keystore: %v

What it means

The command obtains the cluster's key store from the clientset (clientSet.KeyStore(cluster)). A keystore is the abstraction over where keypairs are persisted (e.g. keycert store in the state store); failure to construct it is wrapped with this message.

Source

Thrown at cmd/kops/create_keypair.go:163

// RunCreateKeypair adds a custom CA certificate and private key.
func RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *CreateKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("adding keypair to %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("error getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("error getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return createKeypair(ctx, out, options, options.Keyset, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := createKeypair(ctx, out, options, name, keyStore); err != nil {
				return fmt.Errorf("creating keypair for %s: %v", name, err)
			}
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the cluster spec's keystore configuration (`kops get cluster -o yaml`).
2. Use a kOps version matching the one that created the cluster.
3. Verify state store permissions and integrity of the cluster manifest.
4. Run `kops toolbox dump` / `kops validate cluster` to check overall cluster config health.

Example fix

// before
# keystore misconfigured in cluster spec; create keypair fails
// after
kops edit cluster cluster.k8s.local  # fix/restore default keystore config
kops update cluster --yes && kops create keypair cluster.k8s.local --keyset ca

kops get cluster "$CLUSTER" -o yaml >/dev/null 2>&1 || { echo "cluster spec unreadable; keystore cannot be built"; exit 1; }

if ! out=$(kops create keypair "$CLUSTER" --keyset ca 2>&1); then
  case "$out" in
    *"error getting keystore"*) echo "Inspect cluster keystore config: $out"; kops get cluster "$CLUSTER" -o yaml;;
  esac
fi

When it happens

Trigger: clientSet.KeyStore(cluster) errors during `kops create keypair` — misconfigured or unsupported keystore backend for the cluster (cmd/kops/create_keypair.go:163).

Common situations: Cluster config references a key store backend the CLI can't instantiate; corrupted cluster registry data; older clusters migrated between kOps versions with changed keystore defaults.

Related errors

• cannot specify --key with "all"
• cannot specify --primary with "all"
• adding keypair to %q is not supported
• creating keypair for %s: %v
• error loading private key %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7221890701714910. Report an issue: GitHub.