kubernetes/kops · error

keyset %q not found

Error message

keyset %q not found

What it means

After resolving the keypair ID, buildCertificatePairTask calls KeyStore.FindKeyset to load the named keyset from the state store. A nil result (not an error) means no keyset with that name exists in the keystore, so nodeup cannot write the certificate/key files.

Source

Thrown at nodeup/pkg/model/context.go:397

	if !filepath.IsAbs(p) {
		p = filepath.Join(c.PathSrvKubernetes(), p)
	}

	// We use the keypair ID passed in nodeup.Config instead of the primary
	// keypair so that the node will be updated when the primary keypair does
	// not match the one that we are using.
	keypairID := c.NodeupConfig.KeypairIDs[name]
	if keypairID == "" {
		// kOps bug where KeypairID was not populated for the node role.
		return fmt.Errorf("no keypair ID for %q", name)
	}

	keyset, err := c.KeyStore.FindKeyset(ctx.Context(), name)
	if err != nil {
		return err
	}
	if keyset == nil {
		return fmt.Errorf("keyset %q not found", name)
	}

	item := keyset.Items[keypairID]
	if item == nil {
		return fmt.Errorf("did not find keypair %s for %s", keypairID, name)
	}

	if includeCert {
		certificate := item.Certificate
		if certificate == nil {
			return fmt.Errorf("certificate %q not found", name)
		}

		cert, err := certificate.AsString()
		if err != nil {
			return err
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List keysets with `kops get keypairs` and recreate the missing one: `kops create keypair <name>`
2. Verify the state store location on the node config matches the real cluster state store (KOPS_STATE_STORE)
3. Restore the deleted keyset from a state-store backup (S3 versioning / snapshot)
4. Fix the model builder/builder code if a custom patch passes an incorrect keyset name

keyset, err := keyStore.FindKeyset(ctx, name)
if err != nil { return err }
if keyset == nil { return fmt.Errorf("keyset %q missing from state store; run 'kops create keypair %s'", name, name) }

if err := c.BuildCertificatePairTask(ctx, name, path, filename, owner, nil); err != nil {
    if strings.Contains(err.Error(), "keyset") && strings.Contains(err.Error(), "not found") {
        // recreate keyset in state store then retry
    }
    return err
}

When it happens

Trigger: FindKeyset(ctx, name) returns nil for a keyset name passed to BuildCertificatePairTask/BuildPrivateKeyTask/Build — the keyset is absent from the state store (e.g. the VFS backend) or the name is misspelled by the model builder.

Common situations: State store corrupted or partially deleted (`s3://.../secrets/` keys removed); building a custom model referencing a keyset name that was never created; cluster recreated with a new state store but nodes pointing at the old one.

Related errors

• reading kops-channels manifest %s: %w
• certificate %q not found
• private key %q not found
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e991f726f342c3c7. Report an issue: GitHub.