kubernetes/kops · error

reading keypair-ids.yaml

Error message

reading keypair-ids.yaml

What it means

newKeystore reads keypair-ids.yaml from the CA base path to map keyset names to cloud keypair IDs; this error (note: it drops the underlying err) fires when that file cannot be read - missing, unreadable, or bad permissions. The CA certs and keys themselves loaded fine.

Source

Thrown at cmd/kops-controller/pkg/server/keystore.go:112

		keyBytes, err := os.ReadFile(path.Join(basePath, name+".key"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q key: %v", name, err)
		}
		key, err := pki.ParsePEMPrivateKey(keyBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q key: %v", name, err)
		}

		keystore.keys[name] = keystoreEntry{
			certificate: certificate,
			key:         key,
		}
	}

	var keypairIDs map[string]string
	keypairIDsBytes, err := os.ReadFile(path.Join(basePath, "keypair-ids.yaml"))
	if err != nil {
		return nil, nil, fmt.Errorf("reading keypair-ids.yaml")
	}
	if err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {
		return nil, nil, fmt.Errorf("parsing keypair-ids.yaml")
	}

	// Build keysets
	for name, keypairID := range keypairIDs {
		entry, found := keystore.keys[name]
		if !found {
			// keypair-ids.yaml also includes CAs this server is not configured to serve (e.g. the etcd CAs).
			klog.V(2).Infof("keypair %q found in keypair IDs, not loaded as a served CA", name)
			continue
		}
		primary := &fi.KeysetItem{}
		primary.Id = keypairID
		primary.Certificate = entry.certificate
		primary.PrivateKey = entry.key

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create a valid keypair-ids.yaml in the CABasePath
2. Fix file permissions so kops-controller can read it
3. Verify the file was not accidentally deleted during CA setup

When it happens

Trigger: Thrown at cmd/kops-controller/pkg/server/keystore.go:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6b41e70429ce1bac. Report an issue: GitHub.