kubernetes/kops · error

failed to get keyset from %q

Error message

failed to get keyset from %q

What it means

kubeEnv collects the cluster's CA keysets from the configured keystore tasks (b.caTasks). Each task must expose a Keyset(); if any returns nil, kubeEnv aborts because nodeup cannot be given the cluster's signing key material.

Source

Thrown at pkg/model/bootstrapscript.go:111

		}

		klog.V(8).Infof("Resolved alternateNames %q for %q", addresses, hasAddress)

		for _, wellKnownService := range hasAddress.GetWellKnownServices() {
			wellKnownAddresses[wellKnownService] = append(wellKnownAddresses[wellKnownService], addresses...)
		}
	}

	for k := range wellKnownAddresses {
		sort.Strings(wellKnownAddresses[k])
	}

	keysets := make(map[string]*fi.Keyset)
	for _, caTask := range b.caTasks {
		name := *caTask.Name
		keyset := caTask.Keyset()
		if keyset == nil {
			return nil, fmt.Errorf("failed to get keyset from %q", name)
		}
		keysets[name] = keyset
	}
	config, bootConfig, err := b.builder.NodeUpConfigBuilder.BuildConfig(ig, wellKnownAddresses, keysets)
	if err != nil {
		return nil, err
	}

	configData, err := utils.YamlMarshal(config)
	if err != nil {
		return nil, fmt.Errorf("error converting nodeup config to yaml: %v", err)
	}
	sum256 := sha256.Sum256(configData)
	bootConfig.NodeupConfigHash = base64.StdEncoding.EncodeToString(sum256[:])
	b.nodeupConfig.Resource = fi.NewBytesResource(configData)

	if ig.Spec.Manager == kops.InstanceManagerKarpenter {
		assetBuilder := assets.NewAssetBuilder(vfs.NewVFSContext(), cluster.Spec.Assets, false)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the state store (s3://.../cluster/.../pki) and verify the named keyset exists; restore or recreate it.
2. Re-run cluster creation so the keyset task publishes its keyset before bootstrap script generation.
3. If state is corrupted, use `kops toolbox pki`/exported CA to regenerate keysets, or recreate the cluster from a good backup.

// verify keysets exist in the state store before updating
for _, ks := range []string{"kubernetes-ca", "service-account"} {
  if _, err := keyStore.FindKeyset(ctx, ks); err != nil || keyset == nil {
    return fmt.Errorf("keyset %q missing from state store", ks)
  }
}

When it happens

Trigger: Running `kops update cluster` when a keypair/keystore task exists in the target but its Keyset() is nil — typically when the keyset has not been created/stored yet or was deleted from the key store.

Common situations: Cluster state where the keyset was manually deleted from the state store; interrupted first `kops update cluster` before keysets were stored; corrupted or partially synced state store (e.g. S3/GCS bucket issues).

Related errors

• failed to read %q certificates: %w
• building nodeConfig for instanceGroup: %w
• unsupported cloud provider for authenticator %q
• no keypairID for %q
• challenge not set

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e014a3b0230f82d8. Report an issue: GitHub.