kubernetes/kops · error

keyset %q not found

Error message

keyset %q not found

What it means

kops `trust keypair` trusts (un-distrusts) existing keypairs in a keyset. Before touching any keypair, it looks up the named keyset in the key store; if the store has no entry for it, FindKeyset returns (nil, nil) and the command aborts with `keyset %q not found`. This means the name given to --keyset (or the default keyset name) does not exist in the cluster's key store.

Source

Thrown at cmd/kops/trust_keypair.go:116

		return err
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return err
	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	keyset, err := keyStore.FindKeyset(ctx, options.Keyset)
	if err != nil {
		return err
	}
	if keyset == nil {
		return fmt.Errorf("keyset %q not found", options.Keyset)
	}

	for _, id := range options.KeypairIDs {
		item := keyset.Items[id]
		if item == nil {
			return fmt.Errorf("keypair not found")
		}

		if item.DistrustTimestamp == nil {
			continue
		}

		item.DistrustTimestamp = nil

		if err := keyStore.StoreKeyset(ctx, options.Keyset, keyset); err != nil {
			return fmt.Errorf("error storing keypair: %w", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List available keysets with `kops get keypairs --name <cluster>` and use an exact keyset name
2. Check --name / --state flags point at the intended cluster and state store
3. Recreate the keyset (e.g. `kops replace --force` or `kops create keypair`) if it was deleted

Example fix

// before
kops trust keypair --name mycluster.k8s.local kubernetes-ca-cer i-abc123   # typo
// after
kops get keypairs --name mycluster.k8s.local   # confirm names
kops trust keypair --name mycluster.k8s.local kubernetes-ca i-abc123

keysets, err := client.ListKeysets(ctx) // or: kops get keypairs --name <cluster>
if !slices.Contains(keysets, options.Keyset) {
	return fmt.Errorf("keyset %q does not exist; pick one from: %v", options.Keyset, keysets)
}
_ = client.TrustKeypair(ctx, options)

When it happens

Trigger: Running `kops trust keypair --name <cluster> <keyset> <id>` where <keyset> is not a real keyset name (e.g. a typo like 'kubernetes-ca' instead of 'kubernetes-ca' variants such as 'ca', 'apiserver-aggregator-ca', 'service-account', 'etcd-clients-ca'), or the keyset was deleted from the backend, or the --name points at a cluster whose key store has never been populated.

Common situations: Typo in keyset name; running against a cluster before any keys were created; pointing at the wrong state store/cluster name so the keyset lookup hits an empty store; migrating key storage backends and expecting keys to exist in the new backend.

Related errors

• keypair not found
• no keypairs found
• use 'kops get keypairs' instead
• getting keystore: %v
• listing keysets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ec76c2705670976a. Report an issue: GitHub.