kubernetes/kops · critical

KeyStore not set

Error message

KeyStore not set

What it means

nodeup needs a KeyStore to read cluster CA-signed certificates and keys (kubelet client/server certs). With no config-server NodeConfig, it requires nodeupConfig.ConfigStore.Keypairs to be set; when ConfigStore is nil or Keypairs is empty, Run returns this error at the switch's else branch. Provisioning cannot proceed without access to the cluster PKI.

Source

Thrown at upup/pkg/fi/nodeup/command.go:241

		secretStore = secrets.NewVFSSecretStoreReader(p)
		modelContext.SecretStore = secretStore
	default:
		return fmt.Errorf("SecretStore not set")
	}

	if nodeConfig != nil {
		modelContext.KeyStore = configserver.NewKeyStore()
	} else if nodeupConfig.ConfigStore.Keypairs != "" {
		klog.Infof("Building KeyStore at %q", nodeupConfig.ConfigStore.Keypairs)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)
		if err != nil {
			return fmt.Errorf("error building key store path: %v", err)
		}

		modelContext.KeyStore = fi.NewVFSKeystoreReader(p)
		keyStore = modelContext.KeyStore
	} else {
		return fmt.Errorf("KeyStore not set")
	}

	if err := modelContext.Init(); err != nil {
		return err
	}

	switch bootConfig.CloudProvider {
	case api.CloudProviderAWS:
		instanceIDBytes, err := vfs.Context.ReadFile("metadata://aws/meta-data/instance-id")
		if err != nil {
			return fmt.Errorf("error reading instance-id from AWS metadata: %v", err)
		}
		modelContext.InstanceID = string(instanceIDBytes)

		// Check if WarmPool is enabled first, to avoid additional API calls
		if len(modelContext.NodeupConfig.WarmPoolImages) > 0 {
			modelContext.ConfigurationMode, err = getAWSConfigurationMode(ctx, modelContext)
			if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run 'kops update cluster --yes' with a current kOps version to regenerate nodeupconfig.yaml including configStore.keypairs.
2. Set configStore.keypairs (e.g. s3://bucket/cluster/pki) in the cluster spec and re-apply the update.
3. If you intend config-server mode, configure bootConfig.ConfigServer.Servers so the nodeConfig branch is taken instead.
4. Verify the pki directory actually exists in the state store and contains the cluster CA keypairs (kops get secrets / inspect the bucket).

Example fix

// before (nodeupconfig.yaml)
configStore:
  secrets: s3://bucket/cluster/secrets
// after
configStore:
  secrets: s3://bucket/cluster/secrets
  keypairs: s3://bucket/cluster/pki

// Require a key store source before invoking nodeup
if nodeConfig == nil && (cfg.ConfigStore == nil || cfg.ConfigStore.Keypairs == "") {
    return fmt.Errorf("configStore.keypairs must be set (or use ConfigServer mode)")
}

err := cmd.Run(out)
if err != nil && strings.Contains(err.Error(), "KeyStore not set") {
    // regenerate nodeupconfig.yaml via kops update cluster and verify pki exists
}

When it happens

Trigger: Running NodeUpCommand.Run() in VFS mode where nodeupConfig.ConfigStore is nil or ConfigStore.Keypairs == "" and nodeConfig == nil — the parsed nodeupconfig.yaml has no configStore.keypairs field.

Common situations: State store configs from an older kOps version missing the keypairs field; nodeupconfig.yaml that was hand-trimmed or partially corrupted; config generated for config-server mode but the node boots via VFS without ConfigServer set.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• unknown CA %q
• keyset %q not found
• certificate %q not found
• private key %q not found
• KubeProxy not configured

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/deb70114c153a3ca. Report an issue: GitHub.