What causes "keyset not found" in kubernetes/kops?

List available keysets with `kops get keypairs --name ` and use an exact name.

keyset not found

Error message

keyset not found

What it means

FindKeyset returned success but a nil keyset, meaning no keyset exists under the given name in the cluster's key store. kOps promotes only rotatable keysets (kubernetes-ca, kubernetes-front-proxy-ca, service-account, etc.); requesting a nonexistent or non-rotatable name yields "keyset not found".

Source

Thrown at cmd/kops/promote_keypair.go:161

	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := promoteKeypair(ctx, out, name, "", keyStore); err != nil {
				return fmt.Errorf("promoting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return fmt.Errorf("reading keyset: %v", err)
	} else if keyset == nil {
		return fmt.Errorf("keyset not found")
	}

	if keypairID == "" {
		highestCandidateId := big.NewInt(0)
		for id, item := range keyset.Items {
			if item.PrivateKey != nil && item.DistrustTimestamp == nil && item.Certificate != nil {
				itemId, ok := big.NewInt(0).SetString(id, 10)
				if ok && highestCandidateId.Cmp(itemId) < 0 {
					highestCandidateId = itemId
				}
			}
		}

		keypairID = highestCandidateId.String()
		if keypairID == keyset.Primary.Id {
			fmt.Fprintf(out, "No %s keypair newer than current primary %s\n", name, keypairID)
			return nil
		}

View on GitHub (pinned to 4c8573c808)

Solutions

List available keysets with `kops get keypairs --name <cluster>` and use an exact name.
Fix the keyset spelling — valid rotatable names include kubernetes-ca, kubernetes-front-proxy-ca, service-account, apiserver-aggregator-ca, etcd-clients-ca, etc.
Confirm you are pointed at the intended cluster/state store.
If the keyset genuinely should exist, create/issue it first (`kops create keypair <name>`) before promoting.

Example fix

// before
kops promote keypair kube-ca --name c.example.com
// error: keyset not found
// after: check exact names, then run
kops get keypairs --name c.example.com
kops promote keypair kubernetes-ca --name c.example.com

Defensive patterns

Strategy: validation

Validate before calling

// shell: verify the keyset exists before attempting promotion
KEYSETS=$(kops get keypairs --name "$CLUSTER" --state "$KOPS_STATE_STORE" -o yaml)
echo "$KEYSETS" | grep -q "name: $KEYSET$" || \
  { echo "keyset '$KEYSET' not found; valid names:"; echo "$KEYSETS" | grep '^ *name:'; exit 1; }

Try / catch

if ! kops promote keypair "$KEYSET" --name "$CLUSTER" --state "$KOPS_STATE_STORE" 2>&1 | grep -q 'keyset not found'; then
  kops promote keypair "$KEYSET" --name "$CLUSTER" --state "$KOPS_STATE_STORE"
else
  echo "'$KEYSET' does not exist in this cluster — check spelling via: kops get keypairs"
fi

Prevention

Use shell/tab completion for keyset names instead of typing them from memory.
Copy keyset names from `kops get keypairs` output rather than docs or scripts for other clusters.
Confirm --name/--state point at the intended cluster before promoting.
Remember older clusters may lack newer keysets (e.g. service-account); create them if needed.

When it happens

Trigger: `kops promote keypair <name>` where <name> does not exist in the keystore — a misspelled keyset name, a non-rotatable keyset (already rejected earlier with a different message, so typically a typo), or a keyset never created for this cluster (e.g. service-account missing in very old clusters).

Common situations: Typo in keyset name (e.g. `kube-ca` instead of `kubernetes-ca`); running against a cluster created before a keyset existed; operating on the wrong cluster/state store where the keyset was never issued.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d261feb98a74bf23. Report an issue: GitHub.