kubernetes/kops · error

error listing Keysets: %v

Error message

error listing Keysets: %v

What it means

listKeypairs calls keyStore.ListKeysets() on the cluster's CAStore to enumerate all keysets. If the underlying key store (VFS-backed state store) fails to list — bad state-store path, credentials problem, network error to the backend — the error is wrapped as "error listing Keysets: %v". The root cause is always in the wrapped error.

Source

Thrown at cmd/kops/get_keypairs.go:107

	ID                string     `json:"id"`
	DistrustTimestamp *time.Time `json:"distrustTimestamp,omitempty"`
	IsPrimary         bool       `json:"isPrimary,omitempty"`
	Subject           string     `json:"subject,omitempty"`
	Issuer            string     `json:"issuer,omitempty"`
	AlternateNames    []string   `json:"alternateNames,omitempty"`
	IsCA              bool       `json:"isCA,omitempty"`
	NotBefore         *time.Time `json:"notBefore,omitempty"`
	NotAfter          *time.Time `json:"notAfter,omitempty"`
	KeyLength         *int       `json:"keyLength,omitempty"`
	HasPrivateKey     bool       `json:"hasPrivateKey,omitempty"`
}

func listKeypairs(keyStore fi.CAStore, names []string, includeDistrusted bool) ([]*keypairItem, error) {
	var items []*keypairItem

	l, err := keyStore.ListKeysets()
	if err != nil {
		return nil, fmt.Errorf("error listing Keysets: %v", err)
	}

	for name, keyset := range l {
		if len(names) != 0 {
			found := false
			for _, n := range names {
				if n == name {
					found = true
					break
				}
			}
			if !found {
				continue
			}
		}

		for _, item := range keyset.Items {
			if includeDistrusted || (item.DistrustTimestamp == nil && item.Certificate != nil) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause after the colon and fix that underlying storage error first.
2. Verify KOPS_STATE_STORE / --state points at an existing, accessible bucket and that cloud credentials are valid (e.g. `aws s3 ls $KOPS_STATE_STORE`).
3. Confirm the cluster exists: `kops get clusters`; use the exact cluster name with --name.
4. Retry after restoring network access or IAM permissions (s3:ListBucket / s3:GetObject on the state path).

Example fix

// before
kops get keypairs --name c1.example.com   # wrong state store
// after
export KOPS_STATE_STORE=s3://my-real-kops-state
kops get keypairs --name c1.example.com

# preflight: state store reachable and credentials valid
aws s3 ls "$KOPS_STATE_STORE" >/dev/null 2>&1 || { echo "state store unreachable: $KOPS_STATE_STORE" >&2; exit 2; }

if err := runKops("get", "keypairs", "--name", cluster); err != nil {
	if strings.Contains(err.Error(), "error listing Keysets") {
		// inspect wrapped cause; retry with backoff for transient network/credential errors
	}
	return err
}

When it happens

Trigger: `kops get keypairs ...` where the CAStore's ListKeysets() fails: unreachable/misconfigured --state (e.g. s3://bucket), expired cloud credentials, missing bucket permissions, or a corrupted keyset layout in the state store.

Common situations: AWS credentials expired in CI; wrong KOPS_STATE_STORE value (typo'd bucket or wrong region); state store bucket deleted or permissions changed; network egress blocked to S3/GCS/DO spaces.

Related errors

• reading existing keyset: %v
• reading keyset: %v
• error storing user provided keys %q %q: %v
• listing keysets: %v
• writing keyset: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e2fba5930f1192f0. Report an issue: GitHub.