kubernetes/kops · error

keyStore path is not cluster readable: %v

Error message

keyStore path is not cluster readable: %v

What it means

kops resolves the keypair store (PKI keys) location; if the store implements fi.HasVFSPath but the underlying VFS path is not cluster readable, run() rejects it. Nodes must be able to read the keypair store path during bootstrap.

Source

Thrown at upup/pkg/fi/cloudup/populate_cluster_spec.go:189

	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	if cluster.Spec.ConfigStore.Keypairs == "" {
		hasVFSPath, ok := keyStore.(fi.HasVFSPath)
		if !ok {
			// We will mirror to ConfigBase
			basedir := configBase.Join("pki")
			cluster.Spec.ConfigStore.Keypairs = basedir.Path()
		} else if vfs.IsClusterReadable(hasVFSPath.VFSPath()) {
			vfsPath := hasVFSPath.VFSPath()
			cluster.Spec.ConfigStore.Keypairs = vfsPath.Path()
		} else {
			// We could implement this approach, but it seems better to get all clouds using cluster-readable storage
			return fmt.Errorf("keyStore path is not cluster readable: %v", hasVFSPath.VFSPath())
		}
	}

	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}

	if cluster.Spec.ConfigStore.Secrets == "" {
		hasVFSPath, ok := secretStore.(fi.HasVFSPath)
		if !ok {
			// We will mirror to ConfigBase
			basedir := configBase.Join("secrets")
			cluster.Spec.ConfigStore.Secrets = basedir.Path()
		} else if vfs.IsClusterReadable(hasVFSPath.VFSPath()) {
			vfsPath := hasVFSPath.VFSPath()
			cluster.Spec.ConfigStore.Secrets = vfsPath.Path()
		} else {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the keypair store path is cluster readable: point it at the same cloud object store as configBase and grant nodes read IAM permissions.
2. Leave configStore.keypairs unset so kops mirrors PKI into configBase (under <configBase>/pki).
3. Check the VFS path printed in the error and verify its scheme and permissions.

Example fix

# before
configStore:
  keypairs: file:///etc/kops/pki
# after
configStore:
  keypairs: s3://my-kops-state-bucket/cluster.example.com/pki

if cluster.Spec.ConfigStore.Keypairs != "" && !strings.HasPrefix(cluster.Spec.ConfigStore.Keypairs, "s3://") {
	return fmt.Errorf("keypair store path must be cluster readable")
}

When it happens

Trigger: cluster.spec.configStore.keypairs is empty (so kops derives it from the KeyStore) and the KeyStore's VFS path fails vfs.IsClusterReadable — e.g. a keystore pointed at a non-cluster-accessible bucket or filesystem path.

Common situations: State store in a bucket that nodes cannot access via IAM; keystore relocated via configStore.keypairs to an unreadable path; environments where VFS credentials differ between CLI and nodes.

Related errors

• ConfigStore.Base path is not cluster readable: %v
• secrets path is not cluster readable: %v
• ReadOnlyError
• error reading addons from %q: %v
• error loading channel %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a8802fa7b5b65d0b. Report an issue: GitHub.