FindPrimaryKeypair %q not supported by configserverKeyStore

Error message

FindPrimaryKeypair %q not supported by configserverKeyStore

What it means

configserverKeyStore is a stub KeystoreReader used with the config-server backend that intentionally rejects FindPrimaryKeypair calls, since config-server serves key material only through keysets. Any code path requesting a legacy primary keypair against this store always fails with this sentinel error. It indicates the caller is using an API unsupported by the configserver keystore implementation.

Source

Thrown at pkg/configserver/keystore.go:36

import (
	"context"
	"fmt"

	"k8s.io/kops/pkg/pki"
	"k8s.io/kops/upup/pkg/fi"
)

// configserverKeyStore is a KeyStore backed by the config server.
type configserverKeyStore struct{}

func NewKeyStore() fi.KeystoreReader {
	return &configserverKeyStore{}
}

// FindPrimaryKeypair implements pki.Keystore
func (s *configserverKeyStore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {
	return nil, nil, fmt.Errorf("FindPrimaryKeypair %q not supported by configserverKeyStore", name)
}

// FindKeyset implements KeystoreReader.
func (s *configserverKeyStore) FindKeyset(ctx context.Context, name string) (*fi.Keyset, error) {
	return nil, fmt.Errorf("FindKeyset %q not supported by configserverKeyStore", name)
}

View on GitHub (pinned to 4c8573c808)

Solutions

Migrate the calling code to use FindKeyset instead of FindPrimaryKeypair
Switch the cluster state store away from configserver (e.g. to a supported VFS store) if legacy keypair lookup is required
Check kOps version compatibility: upgrade components so all paths use the keyset API

Example fix

// before
keypair, err := keystore.(fi.KeystoreReader).FindPrimaryKeypair(ctx, name)
// after
keyset, err := keystore.FindKeyset(ctx, name)

Defensive patterns

Strategy: validation

Validate before calling

if ks, ok := store.(*configserverKeyStore); ok {
	return fmt.Errorf("FindPrimaryKeypair unavailable with configserver state store; use FindKeyset")
}
pair, err := store.FindPrimaryKeypair(ctx, name)

Type guard

if _, ok := store.(interface{ FindKeyset(context.Context, string) (*fi.Keyset, error) }); !ok {
	return nil, fmt.Errorf("keystore does not support keyset lookup")
}

Prevention

Prefer FindKeyset over FindPrimaryKeypair in new code
Check the state store type before calling legacy keypair APIs
Keep kOps components version-aligned with the state store backend

When it happens

Trigger: Calling fi.KeystoreReader.FindPrimaryKeypair (or any pki.Keystore consumer such as TLS certificate creation paths) on a keystore obtained from configserver.NewKeyStore().

Common situations: Running a cluster configured with the config-server state store while a component (e.g. nodeup/protokube or pki.CA code) still requests primary keypairs instead of keysets; legacy code paths not yet migrated to FindKeyset.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/65962c3d8fe4759c. Report an issue: GitHub.