kubernetes/kops · error

listing keysets: %v

Error message

listing keysets: %v

What it means

With --keyset all, RunPromoteKeypair lists all keysets from the keystore to promote each rotatable one; this wraps ListKeysets failing - the state store (VFS) could not be read (missing bucket, permissions, or connectivity).

Source

Thrown at cmd/kops/promote_keypair.go:142

	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return promoteKeypair(ctx, out, options.Keyset, options.KeypairID, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := promoteKeypair(ctx, out, name, "", keyStore); err != nil {
				return fmt.Errorf("promoting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return fmt.Errorf("reading keyset: %v", err)
	} else if keyset == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the command — listing may have hit a transient error
2. Check state store permissions and connectivity (aws s3 ls <bucket>/... )
3. If using Vault keystore, ensure the Vault agent/address is healthy
4. Fall back to promoting keysets individually (kubernetes-ca, apiserver-aggregator-ca) to isolate the failing one

Example fix

// before
kops promote keypair all --name c   # fails on listing
// after
kops promote keypair kubernetes-ca --name c
kops promote keypair apiserver-aggregator-ca --name c

aws s3 ls "$KOPS_STATE_STORE/cluster/$CLUSTER/keyset/" >/dev/null || { echo "state store keyset path not readable"; exit 1; }

for i in 1 2 3; do
  kops promote keypair all --name "$CLUSTER" && break
  sleep $((i * 5))
done

When it happens

Trigger: `kops promote keypair all --name <cluster>` where the keystore backend (S3/GCS/etcd/vault) fails while enumerating keyset directories/entries.

Common situations: State store bucket permissions revoked mid-run; Vault agent down when using the Vault keystore; transient network errors to the storage backend; throttling by the cloud provider.

Related errors

• reading keyset: %v
• error creating cluster: %v
• error querying cluster %q: %v
• error writing additional objects: %v
• cluster %q already exists; use 'kops update cluster' to appl

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b5297195e79d5e76. Report an issue: GitHub.