kubernetes/kops · error

getting keyset %q: %w

Error message

getting keyset %q: %w

What it means

GetBootstrapData resolves the keypair names for the instance group and loads each keyset from the keyset store with keystore.FindKeyset. A storage/decoding failure (not a missing entry) is wrapped as 'getting keyset %q: %w'. Missing entries return nil,nil and hit the separate 'did not find keyset' error.

Source

Thrown at pkg/commands/toolbox_enroll.go:822

	}

	configBuilder, err := nodemodel.NewNodeUpConfigBuilder(cluster, assetBuilder, encryptionConfigSecretHash)
	if err != nil {
		return nil, err
	}

	keysets := make(map[string]*fi.Keyset)

	keystore, err := clientset.KeyStore(cluster)
	if err != nil {
		return nil, err
	}

	keyNames := model.KeypairNamesForInstanceGroup(cluster, ig)
	for _, keyName := range keyNames {
		keyset, err := keystore.FindKeyset(ctx, keyName)
		if err != nil {
			return nil, fmt.Errorf("getting keyset %q: %w", keyName, err)
		}

		if keyset == nil {
			return nil, fmt.Errorf("did not find keyset %q", keyName)
		}

		keysets[keyName] = keyset
	}

	nodeupConfig, bootConfig, err := configBuilder.BuildConfig(ig, wellKnownAddresses, keysets)
	if err != nil {
		return nil, err
	}

	var nodeupScript resources.NodeUpScript
	nodeupScript.NodeUpAssets = nodeUpAssets.NodeUpAssets
	nodeupScript.BootConfig = bootConfig

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause to see if it's I/O, permission, or decode failure.
2. Verify read permissions on the state store path (e.g. s3://bucket/cluster/pki/keysets/<name>).
3. Inspect/repair the keyset object; restore from backup if corrupted.
4. Ensure the kops binary version matches the one that wrote the keysets.

Example fix

// before
keyset, err := keystore.FindKeyset(ctx, keyName)
if err != nil { return nil, fmt.Errorf("getting keyset %q: %w", keyName, err) }
// after
// grant s3:GetObject on the pki prefix, then retry:
// aws s3 cp s3://bucket/cluster/pki/keysets/<name>/ -  # verify object is readable & valid

// Check keyset objects are readable before enrollment
// aws s3 cp s3://bucket/cluster/pki/keysets/<name>/ - > /dev/null

if err != nil {
	var permErr *AccessDeniedError
	if errors.As(err, &permErr) {
		return fmt.Errorf("keyset %q unreadable: check state store IAM/KMS: %w", keyName, err)
	}
	return fmt.Errorf("getting keyset %q: %w", keyName, err)
}

When it happens

Trigger: FindKeyset returning an error when reading from the state store: corrupted keyset YAML/JSON, backend I/O failure, permission denied on the S3/GS object, or version incompatibility of stored keyset format.

Common situations: State store object encrypted with a KMS key the caller cannot access; truncated/corrupted object after interrupted kops operation; bucket policy change removing s3:GetObject; kops version upgrade changing keyset serialization expectations.

Related errors

• keyset %q not found
• did not find keyset %q
• error loading NodeupConfig %q: %v
• error querying cluster %q: %v
• adding keypair to %q is not supported

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/87db3b120d0831a4. Report an issue: GitHub.