kubernetes/kops · error

parsing keyset %q: %w

Error message

parsing keyset %q: %w

What it means

Within ListKeysets, each listed Keyset is decoded via parseKeyset; a per-item parse failure is wrapped as 'parsing keyset "<name>": <underlying>' and aborts the whole listing. The underlying cause is usually the certificate/private-key PEM errors from parseKeyset. At upup/pkg/fi/clientset_castore.go:199.

Source

Thrown at upup/pkg/fi/clientset_castore.go:199

// ListKeysets implements CAStore::ListKeysets
func (c *ClientsetCAStore) ListKeysets() (map[string]*Keyset, error) {
	ctx := context.TODO()
	items := map[string]*Keyset{}

	{
		list, err := c.clientset.Keysets(c.namespace).List(ctx, metav1.ListOptions{})
		if err != nil {
			return nil, fmt.Errorf("error listing Keysets: %v", err)
		}

		for i := range list.Items {
			keyset := &list.Items[i]
			switch keyset.Spec.Type {
			case kops.SecretTypeKeypair:
				item, err := parseKeyset(keyset)
				if err != nil {
					return nil, fmt.Errorf("parsing keyset %q: %w", keyset.Name, err)
				}

				items[keyset.Name] = item

			case kops.SecretTypeSecret:
				continue // Ignore - this is handled by ClientsetSecretStore
			default:
				return nil, fmt.Errorf("unhandled secret type %q: %v", keyset.Spec.Type, err)
			}
		}
	}

	return items, nil
}

// StoreKeyset implements CAStore::StoreKeyset
func (c *ClientsetCAStore) StoreKeyset(ctx context.Context, name string, keyset *Keyset) error {
	return c.storeKeyset(ctx, name, keyset)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Identify the named keyset from the message and inspect its material via kubectl get keyset <name> -o yaml -n <namespace>
2. Fix or re-issue the corrupted keypair's material, or delete/recreate the corrupt Keyset object
3. Restore the object from etcd/backup, then re-run the list/mirror operation

// audit stored keysets before listing/mirroring
keysets, _ := kubeClient.Keysets(ns).List(ctx, metav1.ListOptions{})
for _, ks := range keysets.Items {
	for _, k := range ks.Spec.Keys {
		if len(k.PublicMaterial) > 0 && !isPEMCertificate(k.PublicMaterial) {
			return fmt.Errorf("keyset %s has corrupt certificate material", ks.Name)
		}
	}
}

func isPEMCertificate(b []byte) bool {
	block, _ := pem.Decode(b)
	return block != nil && block.Type == "CERTIFICATE"
}

items, err := store.ListKeysets()
if err != nil {
	if strings.Contains(err.Error(), "parsing keyset") {
		// extract keyset name from the message, quarantine it, retry
	}
	return err
}

When it happens

Trigger: One or more Keyset objects in the namespace contain public or private material that fails PEM parsing, so parseKeyset returns an error during the ListKeysets loop.

Common situations: A single corrupted or manually-edited Keyset (e.g. a malformed CA) breaking cluster-wide CA mirroring and any command that enumerates keysets.

Related errors

• private key not provided for primary item
• cannot add secondary item when no existing primary item
• error loading certificate %s/%s: %v
• error loading private key %s/%s: %v
• error reading cluster configuration %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cddee52d711a6482. Report an issue: GitHub.