kubernetes/kops · error

listing keysets: %v

Error message

listing keysets: %v

What it means

With keyset 'all', RunDistrustKeypair lists every keyset from the keystore to distrust each rotatable one; this wraps ListKeysets failing - the state store (VFS) could not be read due to missing bucket, permissions, or connectivity.

Source

Thrown at cmd/kops/distrust_keypair.go:133

	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return err
	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	if options.Keyset != "all" {
		return distrustKeypair(ctx, out, options.Keyset, options.KeypairIDs, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := distrustKeypair(ctx, out, name, nil, keyStore); err != nil {
				return fmt.Errorf("distrusting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func distrustKeypair(ctx context.Context, out io.Writer, name string, keypairIDs []string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return err
	} else if keyset == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the cluster state store path and credentials
2. Check the underlying storage (S3/GCS) is reachable
3. Target a specific keyset instead of 'all' to bypass listing

When it happens

Trigger: Thrown at cmd/kops/distrust_keypair.go:133 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c3348fbe3bee0fae. Report an issue: GitHub.