kubernetes/kops · error

listing keysets: %v

Error message

listing keysets: %v

What it means

With --keyset all, RunCreateKeypair lists all keysets from the cluster keystore to rotate each rotatable one; this wraps ListKeysets failing, i.e. the state store (VFS) could not be read - missing bucket, permissions, or connectivity.

Source

Thrown at cmd/kops/create_keypair.go:172

	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("error getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	if options.Keyset != "all" {
		return createKeypair(ctx, out, options, options.Keyset, keyStore)
	}

	keysets, err := keyStore.ListKeysets()
	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := createKeypair(ctx, out, options, name, keyStore); err != nil {
				return fmt.Errorf("creating keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func createKeypair(ctx context.Context, out io.Writer, options *CreateKeypairOptions, name string, keyStore fi.CAStore) error {
	var err error
	var privateKey *pki.PrivateKey
	if options.PrivateKeyPath != "" {
		options.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the cluster state store path and access credentials
2. Check the underlying storage (S3/GCS) is reachable
3. Run with a specific --keyset to bypass listing if only one keyset is needed

Example fix

// before
kops create keypair cluster.k8s.local --keyset all   # listing fails due to IAM
// after
aws s3 ls s3://my-bucket/cluster.k8s.local/pki/  # verify access, fix IAM, then retry

aws s3 ls "${KOPS_STATE_STORE}/cluster.k8s.local/pki/" >/dev/null 2>&1 || { echo "cannot list pki objects in state store"; exit 1; }

for i in 1 2 3; do
  kops create keypair "$CLUSTER" --keyset all && break
  sleep $((i * 5))
done

When it happens

Trigger: `kops create keypair <cluster> --keyset all` where keyStore.ListKeysets() fails — usually an underlying read failure from the state store (permissions, network, corrupt objects) (cmd/kops/create_keypair.go:172).

Common situations: State store temporarily unavailable; IAM policy denying ListObjects/read on the store; partial/corrupt keycert data left by an interrupted rotation.

Related errors

• error loading NodeupConfig %q: %v
• error querying cluster %q: %v
• error getting cluster: %q: %v
• adding encryptionconfig secret: %v
• updating encryptionconfig secret: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cba2313237d94012. Report an issue: GitHub.