kubernetes/kops · error

no keypairs found

Error message

no keypairs found

What it means

After listing keysets, RunGetKeypairs checks whether any keypair items were returned. If listKeypairs produced an empty slice — no keysets in the store, or none matching the requested names / not including distrusted ones — the command returns "no keypairs found" instead of rendering empty output.

Source

Thrown at cmd/kops/get_keypairs.go:189

	}

	cluster, err := clientset.GetCluster(ctx, options.ClusterName)
	if err != nil {
		return err
	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	items, err := listKeypairs(keyStore, options.KeysetNames, options.Distrusted)
	if err != nil {
		return err
	}

	if len(items) == 0 {
		return fmt.Errorf("no keypairs found")
	}
	switch options.Output {

	case OutputTable:
		t := &tables.Table{}
		t.AddColumn("NAME", func(i *keypairItem) string {
			return i.Name
		})
		t.AddColumn("ID", func(i *keypairItem) string {
			return i.ID
		})
		t.AddColumn("DISTRUSTED", func(i *keypairItem) string {
			if i.DistrustTimestamp != nil {
				return i.DistrustTimestamp.Local().Format("2006-01-02")
			}
			return ""
		})
		t.AddColumn("ISSUED", func(i *keypairItem) string {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops get keypairs` with no name filter to list all keysets and confirm what exists.
2. Add --distrusted if you expect retired/distrusted keypairs to be listed.
3. Verify you are targeting the right cluster with --name <cluster>.
4. If the store is genuinely empty, create the cluster or rotate keys (`kops update keys`) to populate keysets.

Example fix

// before
kops get keypairs kubelet-api   # no such keyset
// after
kops get keypairs                # list available keysets first

# confirm keysets exist before filtering by name
kops get keypairs --name "$CLUSTER" || true   # list all; then pick a valid name

out, err := runKopsOut("get", "keypairs", "--name", cluster)
if err != nil {
	if strings.Contains(err.Error(), "no keypairs found") {
		// empty result: fall back to listing all keysets or add --distrusted
	}
	return err
}

When it happens

Trigger: `kops get keypairs` against a cluster whose state store has no keysets; `kops get keypairs <name>` where <name> does not match any keyset (names filter drops everything); keypairs exist but are all distrusted and --distrusted was not passed.

Common situations: Typo'd keyset name (e.g. `kubectl` instead of `kubernetes-ca`); querying a freshly created cluster before any rotate; expecting distrusted/retired keypairs to appear without the --distrusted flag; pointing at the wrong cluster via --name.

Related errors

• use 'kops get keypairs' instead
• no secrets found
• no SSH public key found
• keyset %q not found
• keypair not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cb828f1e0f5751b1. Report an issue: GitHub.