kubernetes/kops · error

keypair not found

Error message

keypair not found

What it means

After finding the keyset, `kops trust keypair` iterates the IDs passed via positional args and looks each up in keyset.Items. If a given keypair ID does not exist in that keyset, the command fails with `keypair not found`. The keyset exists but the specific keypair ID is wrong or already removed.

Source

Thrown at cmd/kops/trust_keypair.go:122

	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	keyset, err := keyStore.FindKeyset(ctx, options.Keyset)
	if err != nil {
		return err
	}
	if keyset == nil {
		return fmt.Errorf("keyset %q not found", options.Keyset)
	}

	for _, id := range options.KeypairIDs {
		item := keyset.Items[id]
		if item == nil {
			return fmt.Errorf("keypair not found")
		}

		if item.DistrustTimestamp == nil {
			continue
		}

		item.DistrustTimestamp = nil

		if err := keyStore.StoreKeyset(ctx, options.Keyset, keyset); err != nil {
			return fmt.Errorf("error storing keypair: %w", err)
		}

		fmt.Fprintf(out, "Trusted %s %s\n", options.Keyset, id)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops get keypairs --name <cluster> <keyset>` and copy the exact ID from the output
2. Verify you are targeting the right cluster/keyset that actually contains the ID
3. If the keypair is gone, recreate the keypair instead of trusting it

Example fix

// before
kops trust keypair --name c.k8s.local ca 2021   # truncated ID
// after
kops get keypairs --name c.k8s.local ca
kops trust keypair --name c.k8s.local ca 20210101000000

keyset := mustFindKeyset(t)
for _, id := range ids {
	if keyset.Items[id] == nil {
		return fmt.Errorf("keypair %q not in keyset %q; known IDs: %v", id, keyset.Name, slices.Collect(maps.Keys(keyset.Items)))
	}
}

When it happens

Trigger: `kops trust keypair --name <cluster> <keyset> <id>` with an ID that is not present in keyset.Items — e.g. a mistyped or stale ID (IDs are typically timestamps like `20220101120000` or old-item hashes), or the keypair was already deleted/garbage-collected from the keyset.

Common situations: Copy-pasting a keypair ID from a different cluster or keyset; referencing a distrusted-then-deleted keypair; using an ID format from an older kOps version; running `kops get keypairs` output parsing errors that truncated the ID.

Related errors

• keyset %q not found
• no keypairs found
• use 'kops get keypairs' instead
• getting keystore: %v
• listing keysets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5688c08f3e794f8c. Report an issue: GitHub.