kubernetes/kops · error

getting keystore: %v

Error message

getting keystore: %v

What it means

With a cluster and clientset in hand, RunPromoteKeypair calls clientSet.KeyStore(cluster) to build a keystore backed by the cluster's key store configuration. Failure is wrapped as "getting keystore".

Source

Thrown at cmd/kops/promote_keypair.go:133

// RunPromoteKeypair promotes a keypair.
func RunPromoteKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *PromoteKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("promoting keypairs for %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := promoteKeypair(ctx, out, name, "", keyStore); err != nil {
				return fmt.Errorf("promoting keypair for %s: %v", name, err)
			}
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the cluster spec: `kops get cluster <name> -o yaml` and check keyStore settings
2. Upgrade/align kOps client version with the cluster version
3. Repair or remove an unsupported keyStore backend configuration and rely on the default file-based keystore
4. Look at the inner %v error for the backend-specific cause

Example fix

// before (cluster.yaml)
// keyStore: {vault: {agentAddress: "http://127.0.0.1:8200"}}  # unsupported/agent not running
// after
// keyStore: {}  (use default) then kops replace -f cluster.yaml

kops get cluster "$CLUSTER" -o yaml | grep -A2 keyStore || true  # confirm no unsupported keyStore backend

if err := RunPromoteKeypair(ctx, f, out, opts); err != nil {
	if strings.Contains(err.Error(), "getting keystore") {
		log.Printf("inspect cluster keyStore spec: %v", err)
	}
}

When it happens

Trigger: `kops promote keypair` against a cluster whose keyStore configuration in the spec is invalid or unsupported, or an internal error creating the keystore for the cluster's storage backend.

Common situations: Cluster spec with a malformed/unsupported keyStore field (e.g. pointing at an unsupported vault backend); partial migration of cluster spec between kOps versions; corrupted state-store entry.

Related errors

• validation of the full cluster and instance group specs fail
• listing keysets: %v
• promoting keypair for %s: %v
• reading keyset: %v
• keyset %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d58a53b4d294be68. Report an issue: GitHub.