kubernetes/kops · error

reading keyset: %v

Error message

reading keyset: %v

What it means

promoteKeypair calls keyStore.FindKeyset(ctx, name) to load the named keyset (e.g. kubernetes-ca, service-account) from the cluster's key store. If that read returns an error — backend failure, I/O error, or corrupt stored data — it is wrapped as "reading keyset: <cause>" and promotion aborts. The keyset is never modified in this case.

Source

Thrown at cmd/kops/promote_keypair.go:159

	if err != nil {
		return fmt.Errorf("listing keysets: %v", err)
	}

	for name := range keysets {
		if rotatableKeysetFilter(name, nil) {
			if err := promoteKeypair(ctx, out, name, "", keyStore); err != nil {
				return fmt.Errorf("promoting keypair for %s: %v", name, err)
			}
		}
	}

	return nil
}

func promoteKeypair(ctx context.Context, out io.Writer, name string, keypairID string, keyStore fi.CAStore) error {
	keyset, err := keyStore.FindKeyset(ctx, name)
	if err != nil {
		return fmt.Errorf("reading keyset: %v", err)
	} else if keyset == nil {
		return fmt.Errorf("keyset not found")
	}

	if keypairID == "" {
		highestCandidateId := big.NewInt(0)
		for id, item := range keyset.Items {
			if item.PrivateKey != nil && item.DistrustTimestamp == nil && item.Certificate != nil {
				itemId, ok := big.NewInt(0).SetString(id, 10)
				if ok && highestCandidateId.Cmp(itemId) < 0 {
					highestCandidateId = itemId
				}
			}
		}

		keypairID = highestCandidateId.String()
		if keypairID == keyset.Primary.Id {
			fmt.Fprintf(out, "No %s keypair newer than current primary %s\n", name, keypairID)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped cause after "reading keyset: " to identify the backend error.
2. Verify state-store credentials and permissions (cloud CLI auth, KOPS_STATE_STORE/--state value).
3. Retry after transient network/backend issues clear.
4. If the stored keyset object is corrupt, restore it from the state store's versioning/backup or reissue the keypair with `kops replace`/`kops create keypair` before promoting.

Example fix

// before: failing due to bad state store
kops promote keypair kubernetes-ca --name c.example.com
// error: reading keyset: unable to read s3://bucket/... 
// after: pass/verify explicit state store and credentials
export KOPS_STATE_STORE=s3://my-state-store
aws s3 ls $KOPS_STATE_STORE/cluster/c.example.com/pki/  # sanity-check access
kops promote keypair kubernetes-ca --name c.example.com

// pre-flight: confirm the keyset is readable via kops before mutating
kops get keypairs "$KEYSET" --name "$CLUSTER" --state "$KOPS_STATE_STORE" || \
  { echo "keyset $KEYSET unreadable; check credentials/state store"; exit 1; }

for attempt in 1 2 3; do
  kops promote keypair "$KEYSET" --name "$CLUSTER" --state "$KOPS_STATE_STORE" && break
  rc=$?
  echo "attempt $attempt failed (reading keyset); retrying in 10s"
  sleep 10
done
[ "$rc" -eq 0 ] || echo "persistent keyset read failure — check state-store permissions/health"

When it happens

Trigger: Any error returned by fi.CAStore.FindKeyset during `kops promote keypair <keyset>` or `promote keypair all`: unreachable/permission-denied state store, network timeout, malformed/corrupt keyset file in the state store, or vfs backend failure.

Common situations: Wrong or expired cloud credentials; --state pointing at a store the user cannot read; S3/GCS throttling or outage; a keyset JSON/object corrupted by a partial write or manual edit.

Related errors

• reading existing keyset: %v
• error listing Keysets: %v
• listing keysets: %v
• error creating cluster: %v
• error querying cluster %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ac7b8e422236ffb3. Report an issue: GitHub.