kubernetes/kops · error

reading existing keyset: %v

Error message

reading existing keyset: %v

What it means

This error wraps a failure from keyStore.FindKeyset while `kops create keypair` looks up the existing keyset. It fires when the lookup fails with an error other than not-exist, meaning the keyset state could not be read from the backing store (S3/GCS state store or kubernetes backend).

Source

Thrown at cmd/kops/create_keypair.go:247

		cert, err = pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return fmt.Errorf("error loading certificate %q: %v", options.CertPath, err)
		}
	}

	keyset, err := keyStore.FindKeyset(ctx, name)
	var item *fi.KeysetItem
	if os.IsNotExist(err) || (err == nil && keyset == nil) {
		if options.Primary {
			if keyset, err = fi.NewKeyset(cert, privateKey); err != nil {
				return err
			}
		} else {
			return fmt.Errorf("the first keypair added to a keyset must be primary")
		}
		item = keyset.Primary
	} else if err != nil {
		return fmt.Errorf("reading existing keyset: %v", err)
	} else {
		item, err = keyset.AddItem(cert, privateKey, options.Primary)
	}
	if err != nil {
		return err
	}

	err = keyStore.StoreKeyset(ctx, name, keyset)
	if err != nil {
		return fmt.Errorf("error storing user provided keys %q %q: %v", options.CertPath, options.PrivateKeyPath, err)
	}

	if options.CertPath != "" {
		fmt.Fprintf(out, "using user provided cert: %v\n", options.CertPath)
	}
	if options.PrivateKeyPath != "" {
		fmt.Fprintf(out, "using user provided private key: %v\n", options.PrivateKeyPath)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check backend connectivity and credentials with a read command like `kops get cluster`.
2. Verify the --state flag / KOPS_STATE_STORE value is correct.
3. Inspect backend permissions (bucket policy, IAM) for read access to the keyset path.
4. Retry after transient network errors; inspect stored keyset files for corruption.

// Pre-flight the backend with a cheap read
if _, err := keyStore.ListKeysets(); err != nil {
    return fmt.Errorf("key store unreachable: %w", err)
}

if err != nil && strings.Contains(err.Error(), "reading existing keyset") {
    // check state-store credentials/connectivity, then retry with backoff
}

When it happens

Trigger: Calling `kops create keypair` when the key store backend is unreachable, returns permission errors, or has corrupted keyset data for the given name — anything from FindKeyset that is neither nil nor os.IsNotExist.

Common situations: Expired/missing cloud credentials (AWS_PROFILE, session tokens); network outage to S3/GCS; wrong --state / KOPS_STATE_STORE value; corrupted keyset object in the store.

Related errors

• error listing Keysets: %v
• reading keyset: %v
• error storing user provided keys %q %q: %v
• listing keysets: %v
• writing keyset: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6686c03d0443fc88. Report an issue: GitHub.