kubernetes/kops · error

getting clientset: %v

Error message

getting clientset: %v

What it means

RunPromoteKeypair obtains the kops clientset via f.KopsClient(); this wraps that call failing - typically missing/invalid state store configuration or registry setup errors, before any keyset operation begins.

Source

Thrown at cmd/kops/promote_keypair.go:128

	}

	return cmd
}

// RunPromoteKeypair promotes a keypair.
func RunPromoteKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *PromoteKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("promoting keypairs for %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify kubeconfig validity: `kubectl config view` and fix KUBECONFIG
2. Run from an environment where the cluster API is reachable (VPN, correct region)
3. If running in-cluster, ensure the pod's service account allows building the client
4. Re-create the kubeconfig entry for the cluster (kops export kubecfg)

Example fix

// before
export KUBECONFIG=/stale/path/config
// after
kops export kubecfg mycluster.k8s.local --admin
export KUBECONFIG=~/.kube/config

kubectl config current-context && kubectl cluster-info || { echo "kubeconfig broken"; exit 1; }

if err := RunPromoteKeypair(ctx, f, out, opts); err != nil {
	if strings.Contains(err.Error(), "getting clientset") {
		log.Printf("fix KUBECONFIG / API reachability: %v", err)
	}
}

When it happens

Trigger: `kops promote keypair` run when the kops client cannot be built — typically invalid or missing kubeconfig, or in-cluster config unavailable when running inside a cluster.

Common situations: KUBECONFIG pointing at a nonexistent/stale file; running kops inside a pod without a service account token; corrupt kubeconfig after a context switch.

Related errors

• cannot load kubecfg settings for %q: %w
• cannot use both --admin and --user
• cannot use both --all flag and positional arguments
• error creating pod log dumper: %w
• cannot use both --admin and --user

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/55386d83d2df297d. Report an issue: GitHub.