FindKeyset %q not supported by configserverKeyStore

Error message

FindKeyset %q not supported by configserverKeyStore

What it means

configserverKeyStore intentionally returns this error from FindKeyset because the config-server backend does not serve keysets through this store implementation. Any attempt to read keyset material via this stub fails unconditionally. It signals that keyset lookup is unsupported for the configserver state store in this code path.

Source

Thrown at pkg/configserver/keystore.go:41

	"k8s.io/kops/pkg/pki"
	"k8s.io/kops/upup/pkg/fi"
)

// configserverKeyStore is a KeyStore backed by the config server.
type configserverKeyStore struct{}

func NewKeyStore() fi.KeystoreReader {
	return &configserverKeyStore{}
}

// FindPrimaryKeypair implements pki.Keystore
func (s *configserverKeyStore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {
	return nil, nil, fmt.Errorf("FindPrimaryKeypair %q not supported by configserverKeyStore", name)
}

// FindKeyset implements KeystoreReader.
func (s *configserverKeyStore) FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) {
	return nil, fmt.Errorf("FindKeyset %q not supported by configserverKeyStore", name)
}

View on GitHub (pinned to 4c8573c808)

Solutions

Ensure key material is fetched from the config server itself rather than the local keystore stub
Use a supported state store backend that implements FindKeyset
Upgrade kOps so the code path uses config-server APIs instead of local keyset reads

Defensive patterns

Strategy: validation

Validate before calling

if isConfigServerStore(store) {
	return fetchKeysetFromConfigServer(ctx, name)
}
ks, err := store.FindKeyset(ctx, name)

Type guard

type keysetReader interface{ FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) }
if _, ok := store.(keysetReader); !ok { /* use config-server client instead */ }

Prevention

Do not point legacy keystore consumers at a configserver state store
Fetch key material via config-server APIs when using configserver
Document which state store backends support keyset reads

When it happens

Trigger: Calling configserverKeyStore.FindKeyset(ctx, name) for any keyset name, e.g. from keystore consumers building cluster secrets or TLS material against a config-server state store.

Common situations: Configuring kOps with a config-server state store while a component performs keyset reads locally; misconfigured KOPS_STATE_STORE pointing at configserver for operations that need local key material.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/30bd852f50c8d648. Report an issue: GitHub.