kubernetes/kops · error

error listing Keysets: %v

Error message

error listing Keysets: %v

What it means

ListKeysets lists all Keyset objects in the store's namespace; any List API error (other than being wrapped per-item) is returned as 'error listing Keysets: <underlying>'. This blocks building the keyset map used e.g. by MirrorTo. From upup/pkg/fi/clientset_castore.go:190.

Source

Thrown at upup/pkg/fi/clientset_castore.go:190

	}
	if keyset.Primary == nil {
		return nil, nil, nil
	}
	if keyset.Primary.Certificate == nil {
		return nil, nil, nil
	}
	return keyset.Primary.Certificate, keyset.Primary.PrivateKey, nil
}

// ListKeysets implements CAStore::ListKeysets
func (c *ClientsetCAStore) ListKeysets() (map[string]*Keyset, error) {
	ctx := context.TODO()
	items := map[string]*Keyset{}

	{
		list, err := c.clientset.Keysets(c.namespace).List(ctx, metav1.ListOptions{})
		if err != nil {
			return nil, fmt.Errorf("error listing Keysets: %v", err)
		}

		for i := range list.Items {
			keyset := &list.Items[i]
			switch keyset.Spec.Type {
			case kops.SecretTypeKeypair:
				item, err := parseKeyset(keyset)
				if err != nil {
					return nil, fmt.Errorf("parsing keyset %q: %w", keyset.Name, err)
				}

				items[keyset.Name] = item

			case kops.SecretTypeSecret:
				continue // Ignore - this is handled by ClientsetSecretStore
			default:
				return nil, fmt.Errorf("unhandled secret type %q: %v", keyset.Spec.Type, err)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm kubectl get keysets -A (or -n <namespace>) works with the same credentials
2. Fix RBAC to allow listing keysets in the kops system namespace
3. Restore API server connectivity / refresh expired kubeconfig tokens
4. Retry if the wrapped error is transient (timeouts, connection resets)

// verify list permission up front
_, err := kubeClient.Keysets(ns).List(ctx, metav1.ListOptions{})
if err != nil {
	return fmt.Errorf("list permission check failed in %s: %w", ns, err)
}

items, err := store.ListKeysets()
if err != nil {
	if strings.Contains(err.Error(), "error listing Keysets") {
		// retry with backoff; check RBAC/API health
	}
	return err
}

When it happens

Trigger: clientset.Keysets(namespace).List fails: API server unreachable, RBAC forbids listing keysets, context deadline exceeded, bad namespace.

Common situations: Running 'kops admin' / CA store mirror operations with credentials lacking list permissions; offline/intranet mode with no API access; expired tokens during long-running operations.

Related errors

• error querying namespace %q: %v
• error listing objects: %w
• error listing nodes: %v
• error getting host %v: %w
• error listing nodes: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9d2eeb6fe26272d5. Report an issue: GitHub.