kubernetes/kops · error

keypair not found

Error message

keypair not found

What it means

This error is returned by promoteKeypair when the keypairID supplied to `kops promote keypair` does not match any item in the named keyset. kOps looks up keyset.Items[keypairID]; if that map entry is nil it cannot promote a nonexistent keypair and fails. It protects against promoting or re-pointing the primary at an ID that simply does not exist in the store.

Source

Thrown at cmd/kops/promote_keypair.go:191

		}

		keypairID = highestCandidateId.String()
		if keypairID == keyset.Primary.Id {
			fmt.Fprintf(out, "No %s keypair newer than current primary %s\n", name, keypairID)
			return nil
		}
	} else if item := keyset.Items[keypairID]; item != nil {
		if item.DistrustTimestamp != nil {
			return fmt.Errorf("keypair is distrusted")
		}
		if item.PrivateKey == nil {
			return fmt.Errorf("keypair has no private key")
		}
		if item.Certificate == nil {
			return fmt.Errorf("keypair has no certificate")
		}
	} else {
		return fmt.Errorf("keypair not found")
	}

	keyset.Primary = keyset.Items[keypairID]
	err = keyStore.StoreKeyset(ctx, name, keyset)
	if err != nil {
		return fmt.Errorf("writing keyset: %v", err)
	}

	fmt.Fprintf(out, "Promoted %s %s\n", name, keypairID)
	return nil
}

func completePromoteKeyset(ctx context.Context, f commandutils.Factory, options *PromoteKeypairOptions, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
	commandutils.ConfigureKlogForCompletion()

	cluster, clientSet, completions, directive := GetClusterForCompletion(ctx, f, nil)
	if cluster == nil {
		return completions, directive

View on GitHub (pinned to 4c8573c808)

Solutions

1. List the actual keypair IDs with `kops get keypairs <name>` and re-run promote with an ID that exists in that keyset.
2. Confirm you are targeting the right cluster and state store (--name, --state flags) so you are not looking into a different keyset.
3. Omit the keypairID entirely — `kops promote keypair <name>` — so kOps auto-selects the highest valid candidate (private key + certificate, not distrusted).
4. If the keypair was deleted, restore it from the state store backup or re-create it via rotation before promoting.

Example fix

// before: ID that doesn't exist in this keyset
// kops promote keypair ca 99   ->  "keypair not found"
// after: discover real IDs first, then promote
// kops get keypairs ca
// kops promote keypair ca 3

if _, ok := keyset.Items[keypairID]; !ok {
    return fmt.Errorf("keypair %s does not exist in keyset %s", keypairID, name)
}
// CLI-side: `kops get keypairs <name>` and pick an ID from the output

func keypairExists(keyset *fi.Keyset, id string) bool {
	return keyset != nil && keyset.Items != nil && keyset.Items[id] != nil
}

When it happens

Trigger: Running `kops promote keypair <name> <keypairID>` with an ID that is not a key in keyset.Items — e.g. a typo in the numeric ID, referencing an ID from a different keyset (ca vs service-account), or an ID from a different cluster/state store, or referencing a keypair that was already deleted.

Common situations: Typo or wrong revision number when copying an ID from `kops get keypairs`; running against the wrong --name or --state so the target keyset is a different one; the keypair was deleted (or rotated away / pruned) before the promote was retried; scripting that carries stale IDs across runs.

Related errors

• keypair has no certificate
• error getting keystore: %v
• the first keypair added to a keyset must be primary
• promoting keypair for %s: %v
• keypair has no private key

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bf8e0bbec0277dee. Report an issue: GitHub.