kubernetes/kops · error

reading keyset for %s: %v

Error message

reading keyset for %s: %v

What it means

While resolving the signer's keyset from the keystore reader, FindKeyset returned an error; it is wrapped with the signer name. This is a read/transport failure against the cluster keystore, not a 'not found' case.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/issue_cert.go:227

func (s staticKeystore) FindPrimaryKeypair(ctx context.Context, name string) (*pki.Certificate, *pki.PrivateKey, error) {
	if name != s.keyset {
		return nil, nil, fmt.Errorf("wrong signer: expected %q got %q", s.keyset, name)
	}
	return s.certificate, s.key, nil
}

func newStaticKeystore(ctx context.Context, signer string, keypairID string, keystore fi.KeystoreReader) (pki.Keystore, error) {
	if signer == "" {
		return nil, nil
	}

	if keypairID == "" {
		return nil, fmt.Errorf("missing keypairID for signer %s", signer)
	}

	keyset, err := keystore.FindKeyset(ctx, signer)
	if err != nil {
		return nil, fmt.Errorf("reading keyset for %s: %v", signer, err)
	}
	if keyset == nil {
		return nil, fmt.Errorf("keyset %q not found", signer)
	}

	item := keyset.Items[keypairID]
	if item == nil {
		return nil, fmt.Errorf("no keypair with id %s for %s", keypairID, signer)
	}

	return &staticKeystore{
		keyset:      signer,
		certificate: item.Certificate,
		key:         item.PrivateKey,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the inner error for the store backend failure (permissions, network, not-found parse errors)
2. Verify node IAM/credentials can read the state store pki paths
3. Validate the keyset file in the state store parses (e.g. kops get keysets / inspect YAML)
4. Retry nodeup once the backend is reachable

Example fix

// before
// node role lacks s3:GetObject on pki keyset objects
// after
// add s3:GetObject on <state-store>/<cluster>/pki/* to the node instance profile

// pre-check store reachability
ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
defer cancel()
_, err := keystoreReader.FindKeyset(ctx, signer) // surface early

ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)
if err != nil && strings.HasPrefix(err.Error(), "reading keyset") {
  return fi.NewTryAgainLaterError("keystore temporarily unreadable")
}

When it happens

Trigger: newStaticKeystore calls keystore.FindKeyset(ctx, signer) during IssueCert Run and the underlying store errors (VFS/backend failure).

Common situations: State store unreachable (S3/GCS permissions, network); corrupted keyset YAML in the state store; node cannot reach the cluster state backend during bootstrap.

Related errors

• error building key store path: %v
• server-side client does not support MirrorTo
• parsing path for kops-channels manifest %s: %w
• reading kops-channels manifest %s: %w
• keyset %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8ef230c2eaceef97. Report an issue: GitHub.