kubernetes/kops · error

error reading keyset %q: %v

Error message

error reading keyset %q: %v

What it means

ClientsetCAStore.loadKeyset fetches the Keyset object from the cluster registry. A non-NotFound error from the API Get is wrapped as 'error reading keyset "<name>": <underlying>'. NotFound returns (nil, nil) so this error specifically signals an API/transport/permission failure, not absence. From upup/pkg/fi/clientset_castore.go:117 via FindKeyset.

Source

Thrown at upup/pkg/fi/clientset_castore.go:117

			ki.PrivateKey = privateKey
		}

		keyset.Items[key.Id] = ki
	}

	keyset.Primary = keyset.Items[FindPrimary(o).Id]

	return keyset, nil
}

// loadKeyset gets the named Keyset and the format of the Keyset.
func (c *ClientsetCAStore) loadKeyset(ctx context.Context, name string) (*Keyset, error) {
	o, err := c.clientset.Keysets(c.namespace).Get(ctx, name, metav1.GetOptions{})
	if err != nil {
		if errors.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error reading keyset %q: %v", name, err)
	}

	keyset, err := parseKeyset(o)
	if err != nil {
		return nil, err
	}
	return keyset, nil
}

// FindPrimary returns the primary KeysetItem in the Keyset
func FindPrimary(keyset *kops.Keyset) *kops.KeysetItem {
	var primary *kops.KeysetItem
	var primaryVersion *big.Int

	primaryId := keyset.Spec.PrimaryID

	for i := range keyset.Spec.Keys {
		item := &keyset.Spec.Keys[i]

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify cluster API server reachability: kubectl cluster-info / kubectl get keysets -n <namespace>
2. Check RBAC: ensure the credentials in the kops kubeconfig may get keysets in the kops namespace
3. Inspect the wrapped underlying error for timeout vs forbidden and fix connectivity or credentials accordingly
4. Retry the operation if the underlying error is transient (e.g. connection refused, timeouts)

Example fix

// before
keyset, _ := store.FindKeyset(ctx, name)
// after: surface and handle transient errors
keyset, err := store.FindKeyset(ctx, name)
if err != nil {
	return fmt.Errorf("find keyset: %w", err) // underlying cause preserved
}

// pre-flight: ensure API + RBAC allow reading keysets
if _, err := kubeClient.Keysets(ns).List(ctx, metav1.ListOptions{}); err != nil {
	return fmt.Errorf("cannot read keysets in %s: %w", ns, err)
}

keyset, err := store.FindKeyset(ctx, name)
if err != nil {
	if strings.Contains(err.Error(), "error reading keyset") {
		// transient API failure: backoff and retry
	}
	return err
}

When it happens

Trigger: Keysets(...).Get fails with anything other than IsNotFound: API server unreachable, RBAC denial (keysets forbidden), context timeout/cancellation, invalid namespace.

Common situations: kOps hitting a cluster whose API server is down or behind a broken load balancer; kubeconfig with insufficient RBAC to read keysets in the namespace; network partitions during 'kops update cluster' or CA mirroring.

Related errors

• error creating keyset %q: %v
• error listing Keysets: %v
• error updating keyset %q: %v
• error querying namespace %q: %v
• CAPI Machine is missing cluster.x-k8s.io/deployment-name lab

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d57846af9402c874. Report an issue: GitHub.