kubernetes/kops · error

keyset %q not found

Error message

keyset %q not found

What it means

Render of the keypair task assumes it wants to re-save the keyset in the preferred format. It looks up the keyset by name; when FindKeyset returns nil, the named keyset (certificate/key pair) does not exist in the keystore, so the task fails with this error.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:251

			return err
		} else if roundtrip == nil {
			return fmt.Errorf("unable to find created certificate %q: %w", name, err)
		}

		klog.V(8).Infof("created certificate with subject %v", subjectPkix)
	}

	// TODO: Check correct subject / flags

	if changeStoredFormat {
		// We fetch and reinsert the same keypair, forcing an update to our preferred format
		// TODO: We're assuming that we want to save in the preferred format
		keyset, err := c.T.Keystore.FindKeyset(ctx, name)
		if err != nil {
			return err
		}
		if keyset == nil {
			return fmt.Errorf("keyset %q not found", name)
		}

		keyset.LegacyFormat = false
		err = c.T.Keystore.StoreKeyset(ctx, name, keyset)
		if err != nil {
			return err
		}

		klog.Infof("updated Keypair %q to new format", name)
	}

	return nil

}

func CreateKeyset(ctx context.Context, keystore fi.Keystore, name string, req pki.IssueCertRequest) (*fi.Keyset, error) {
	keyset, err := keystore.FindKeyset(ctx, name)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Recreate the missing keyset: run kops with the keypair task enabled (e.g. `kops update cluster`) so the certificate is generated and stored.
2. Check the state store pki directory (s3://<bucket>/<cluster>/pki/) for the missing keyset and restore it from backup.
3. Verify the keyset name in the cluster spec / task definitions matches an existing keyset exactly (case-sensitive).
4. If the keystore uses legacy format, ensure migration ran; missing legacy keysets can appear absent.

Example fix

// before: cluster pki deleted
// after: restore keyset then re-run
// kops toolbox dump / manual copy of pki/<name>.keyset back into state store, then:
// kops update cluster <name> --yes

ks, err := keystore.FindKeyset(ctx, keypairName)
if err != nil || ks == nil { /* recreate or restore before applying */ }

if keyset == nil { return fmt.Errorf("keyset %q not found", name) }

if err != nil { return fmt.Errorf("loading keyset %q: %w", name, err) }

When it happens

Trigger: Render calls c.T.Keystore.FindKeyset(ctx, name) for a keypair name that has never been created and is not present in the cluster's keystore (pki directory / secret store).

Common situations: Deleted or truncated cluster pki data in the state store, typo'd keypair alternate names, restoring a partial cluster backup, or a keyset expected from a previous keystore migration that never happened.

Related errors

• certificate %q not found
• error creating certificate: %w
• unable to issue certificate: %v
• unable to find created certificate %q: %w
• unknown CA %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/928e536cee196a9d. Report an issue: GitHub.