kubernetes/kops · error

keyset not found

Error message

keyset not found

What it means

distrustKeypair looked up the named keyset via FindKeyset; the lookup itself succeeded but returned nil, meaning no keyset with that name exists in the cluster keystore. This is a name/validation mismatch, not a store failure.

Source

Thrown at cmd/kops/distrust_keypair.go:152

	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := distrustKeypair(ctx, out, name, nil, keyStore); err != nil {
				return fmt.Errorf("distrusting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func distrustKeypair(ctx context.Context, out io.Writer, name string, keypairIDs []string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return err
	} else if keyset == nil {
		return fmt.Errorf("keyset not found")
	}

	if len(keypairIDs) == 0 {
		primarySerial := keyset.Primary.Certificate.Certificate.SerialNumber
		for id, item := range keyset.Items {
			if item.DistrustTimestamp == nil && item.Certificate.Certificate.SerialNumber.Cmp(primarySerial) < 0 {
				keypairIDs = append(keypairIDs, id)
			}
		}

		if len(keypairIDs) == 0 {
			klog.Infof("No %s keypairs older than the primary.", name)
			return nil
		}
	}

	for _, id := range keypairIDs {
		if id == keyset.Primary.Id {

View on GitHub (pinned to 4c8573c808)

Solutions

1. List existing keysets (e.g. kops get keypairs) to find the correct name
2. Check the keyset name for typos

When it happens

Trigger: Thrown at cmd/kops/distrust_keypair.go:152 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8e23dcd98fccfbb9. Report an issue: GitHub.