What causes "error storing user provided keys %q %q: %v" in kubernetes/kops?

Verify write permissions on the state store bucket/path for your credentials.

error storing user provided keys %q %q: %v

Error message

error storing user provided keys %q %q: %v

What it means

This error wraps a failure from keyStore.StoreKeyset when persisting the new or updated keyset at the end of `kops create keypair`. Despite the message naming 'user provided keys', it fires for generated keys too; the keyset was built successfully but could not be written to the backing store.

Source

Thrown at cmd/kops/create_keypair.go:257

			if keyset, err = fi.NewKeyset(cert, privateKey); err != nil {
				return err
			}
		} else {
			return fmt.Errorf("the first keypair added to a keyset must be primary")
		}
		item = keyset.Primary
	} else if err != nil {
		return fmt.Errorf("reading existing keyset: %v", err)
	} else {
		item, err = keyset.AddItem(cert, privateKey, options.Primary)
	}
	if err != nil {
		return err
	}

	err = keyStore.StoreKeyset(ctx, name, keyset)
	if err != nil {
		return fmt.Errorf("error storing user provided keys %q %q: %v", options.CertPath, options.PrivateKeyPath, err)
	}

	if options.CertPath != "" {
		fmt.Fprintf(out, "using user provided cert: %v\n", options.CertPath)
	}
	if options.PrivateKeyPath != "" {
		fmt.Fprintf(out, "using user provided private key: %v\n", options.PrivateKeyPath)
	}
	fmt.Fprintf(out, "Created %s %s\n", name, item.Id)
	return nil
}

func completeKeyset(ctx context.Context, cluster *kopsapi.Cluster, clientSet simple.Clientset, args []string, filter func(name string, keyset *fi.Keyset) bool) (keyset *fi.Keyset, keyStore fi.CAStore, completions []string, directive cobra.ShellCompDirective) {
	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		completions, directive := commandutils.CompletionError("getting keystore", err)
		return nil, nil, completions, directive
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Verify write permissions on the state store bucket/path for your credentials.
Confirm connectivity with a read command, then retry the write.
Check for Object Lock / retention / read-only bucket settings blocking writes.
For file:// state stores, check disk space and directory permissions.

Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "error storing user provided keys") {
    // inspect wrapped cause; verify bucket write IAM; retry with backoff
}

Prevention

Grant the invoking identity write access to the state store prefix.
Verify Object Lock and retention policies don't block overwrites.
Ensure sufficient disk space for file:// state stores.
Retry after transient cloud storage errors.

When it happens

Trigger: Running `kops create keypair` when the key store backend rejects the write: permission denied on the state store, read-only bucket, Object Lock/retention policies, network failure mid-write, or full disk for file:// stores.

Common situations: State store bucket write permissions missing or IAM too restrictive; bucket deny policy or Object Lock; temporary cloud storage outage; disk full for file:// state stores.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/61e387938fdd2c0c. Report an issue: GitHub.