kubernetes/kops · error

keyset %q not found

Error message

keyset %q not found

What it means

FindKeyset succeeded but returned a nil keyset, meaning no keyset exists under the requested signer name. The function reports it plainly with the signer name quoted.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/issue_cert.go:230

	}
	return s.certificate, s.key, nil
}

func newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {
	if signer == "" {
		return nil, nil
	}

	if keypairID == "" {
		return nil, fmt.Errorf("missing keypairID for signer %s", signer)
	}

	keyset, err := keystore.FindKeyset(ctx, signer)
	if err != nil {
		return nil, fmt.Errorf("reading keyset for %s: %v", signer, err)
	}
	if keyset == nil {
		return nil, fmt.Errorf("keyset %q not found", signer)
	}

	item := keyset.Items[keypairID]
	if item == nil {
		return nil, fmt.Errorf("no keypair with id %s for %s", keypairID, signer)
	}

	return &staticKeystore{
		keyset:      signer,
		certificate: item.Certificate,
		key:         item.PrivateKey,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List keysets in the state store and use the actual keyset name in the IssueCert Signer field
2. Create/re-issue the CA keyset if it is genuinely missing (kops will regenerate on apply)
3. Check for renamed signers after upgrading kOps and update the cluster spec
4. Restore pki data from backup if it was deleted

Example fix

// before
Signer: fi.String("etcd-clients-ca") // keyset deleted from store
// after
Signer: fi.String("etcd-clients-ca") + run `kops update cluster` to recreate the keyset

keyset, _ := keystoreReader.FindKeyset(ctx, signer)
if keyset == nil {
  return fmt.Errorf("keyset %q missing; run kops update cluster to create it", signer)
}

ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)
if err != nil && strings.Contains(err.Error(), "keyset \""+signer+"\" not found") {
  // trigger keyset recreation via kops apply before re-running nodeup
}

When it happens

Trigger: newStaticKeystore looks up e.g. "kubernetes-ca" and the store has no such keyset (name never created, renamed, or deleted).

Common situations: Signer renamed between kOps versions or in a customized spec; state store pruned of old keysets; typo in the signer name; cluster migrated without copying pki data.

Related errors

• keyset %q not found
• certificate %q not found
• private key %q not found
• encoding service-account keys: %w
• error building key store path: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/381512c1e7ba50c3. Report an issue: GitHub.