kubernetes/kops · error

keypair not found

Error message

keypair not found

What it means

While distrustKeypair iterates the requested keypair IDs, one ID has no corresponding item in keyset.Items - the ID does not match any certificate in the named keyset. Other IDs may be valid; the loop aborts at the bad one.

Source

Thrown at cmd/kops/distrust_keypair.go:175

		for id, item := range keyset.Items {
			if item.DistrustTimestamp == nil && item.Certificate.Certificate.SerialNumber.Cmp(primarySerial) < 0 {
				keypairIDs = append(keypairIDs, id)
			}
		}

		if len(keypairIDs) == 0 {
			klog.Infof("No %s keypairs older than the primary.", name)
			return nil
		}
	}

	for _, id := range keypairIDs {
		if id == keyset.Primary.Id {
			return fmt.Errorf("cannot distrust the primary keypair")
		}
		item := keyset.Items[id]
		if item == nil {
			return fmt.Errorf("keypair not found")
		}

		if item.DistrustTimestamp != nil {
			continue
		}

		now := time.Now().UTC().Round(0)
		item.DistrustTimestamp = &now

		if err := keyStore.StoreKeyset(ctx, name, keyset); err != nil {
			return fmt.Errorf("error storing keyset: %w", err)
		}

		fmt.Fprintf(out, "Distrusted %s %s\n", name, id)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List the keyset's keypair IDs to find valid IDs
2. Check the ID for typos or staleness (it may refer to a rotated-away keypair)

When it happens

Trigger: Thrown at cmd/kops/distrust_keypair.go:175 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e9d8e5d69ff45951. Report an issue: GitHub.