kubernetes/kops · error

parsing keypair-ids.yaml

Error message

parsing keypair-ids.yaml

What it means

newKeystore unmarshals the previously read keypair-ids.yaml bytes into a map; this fires when the YAML is syntactically invalid or does not match map[string]string. The file exists and is readable, but its content is malformed.

Source

Thrown at cmd/kops-controller/pkg/server/keystore.go:115

		}
		key, err := pki.ParsePEMPrivateKey(keyBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q key: %v", name, err)
		}

		keystore.keys[name] = keystoreEntry{
			certificate: certificate,
			key:         key,
		}
	}

	var keypairIDs map[string]string
	keypairIDsBytes, err := os.ReadFile(path.Join(basePath, "keypair-ids.yaml"))
	if err != nil {
		return nil, nil, fmt.Errorf("reading keypair-ids.yaml")
	}
	if err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {
		return nil, nil, fmt.Errorf("parsing keypair-ids.yaml")
	}

	// Build keysets
	for name, keypairID := range keypairIDs {
		entry, found := keystore.keys[name]
		if !found {
			// keypair-ids.yaml also includes CAs this server is not configured to serve (e.g. the etcd CAs).
			klog.V(2).Infof("keypair %q found in keypair IDs, not loaded as a served CA", name)
			continue
		}
		primary := &fi.KeysetItem{}
		primary.Id = keypairID
		primary.Certificate = entry.certificate
		primary.PrivateKey = entry.key

		keyset := &fi.Keyset{}
		keyset.Primary = primary
		keyset.Items = make(map[string]*fi.KeysetItem)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the YAML syntax in keypair-ids.yaml
2. Ensure the file is a flat mapping of keyset name to keypair ID string

When it happens

Trigger: Thrown at cmd/kops-controller/pkg/server/keystore.go:115 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9aa60382ef82c9b5. Report an issue: GitHub.