kubernetes/kops · error

keyset %q not found

Error message

keyset %q not found

What it means

After confirming the keypair ID exists, findJWKSForServiceAccount reads the 'service-account' keyset from the cluster keystore. If FindKeyset returns nil (keyset absent from state store) rather than an error, this explicit error is returned because no JWKS can be built without the signing keys.

Source

Thrown at nodeup/pkg/model/discovery_service.go:116

	return nil
}

func findJWKSForServiceAccount(ctx context.Context, keypairIDs map[string]string, keystore fi.KeystoreReader) ([]nodetasks.JSONWebKey, error) {
	var jwks []nodetasks.JSONWebKey

	name := "service-account"
	keypairID := keypairIDs[name]
	if keypairID == "" {
		// kOps bug where KeypairID was not populated for the node role.
		return nil, fmt.Errorf("no keypair ID for %q", name)
	}

	keyset, err := keystore.FindKeyset(ctx, name)
	if err != nil {
		return nil, err
	}
	if keyset == nil {
		return nil, fmt.Errorf("keyset %q not found", name)
	}

	for _, item := range keyset.Items {
		if item.DistrustTimestamp != nil {
			continue
		}
		if item.Certificate == nil || item.Certificate.Subject.CommonName != "service-account" {
			continue
		}

		publicKey := item.Certificate.PublicKey

		jwk := nodetasks.JSONWebKey{}

		{
			jwk.KeyID = item.Id
			// publicKeyDERBytes, err := x509.MarshalPKIXPublicKey(publicKey)
			// if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check `kops get keypairs service-account` in the state store; if absent, re-create with `kops update cluster` (it issues the service-account signer)
2. Restore the service-account keyset from a state-store backup
3. Run `kops toolbox dump` / inspect the state store's pki directory to confirm the keyset exists
4. Re-issue cluster secrets: `kops update cluster --refresh-cluster-issue-certificates`

Example fix

# verify and re-issue missing keyset
kops get keypairs --type secrets | grep service-account
kops update cluster mycluster.example.com --yes --refresh-cluster-issue-certificates

# confirm the keyset exists in the state store before nodeup runs
kops get keypairs service-account --type secrets || \
  { echo 'service-account keyset missing; run kops update cluster'; exit 1; }

keyset, err := keystore.FindKeyset(ctx, "service-account")
if err != nil {
	return err
}
if keyset == nil {
	// re-issue the service-account signer before retrying JWKS construction
	return fmt.Errorf("service-account keyset absent from state store; run kops update cluster --refresh-cluster-issue-certificates")
}

When it happens

Trigger: keystore.FindKeyset(ctx, "service-account") returns (nil, nil) — the service-account keyset does not exist in the cluster state store (S3/GCS/OSS bucket) even though the keypair ID map references it.

Common situations: Cluster state store was pruned, restored partially, or migrated losing the service-account key; keypair ID cached in nodeup config points at a key deleted from state; creating a discovery-service registration before the CA/service-account keys are ever issued.

Related errors

• getting keyset %q: %w
• reading existing keyset: %v
• error storing user provided keys %q %q: %v
• error listing Keysets: %v
• listing keysets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cdda8da6205cff4d. Report an issue: GitHub.