kubernetes/kops · error

reading %q key: %v

Error message

reading %q key: %v

What it means

newKeystore reads the <name>.key private-key file for a CA from the CA base path; this wraps os.ReadFile failing, i.e. the key file is missing, unreadable, or has wrong permissions. The matching certificate was already loaded successfully.

Source

Thrown at cmd/kops-controller/pkg/server/keystore.go:96

func newKeystore(basePath string, cas []string) (*keystore, map[string]string, error) {
	keystore := &keystore{
		keys:    map[string]keystoreEntry{},
		keySets: map[string]*fi.Keyset{},
	}
	for _, name := range cas {
		certBytes, err := os.ReadFile(path.Join(basePath, name+".crt"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q certificate: %v", name, err)
		}
		// TODO: Support multiple certificates?
		certificate, err := pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q certificate: %v", name, err)
		}

		keyBytes, err := os.ReadFile(path.Join(basePath, name+".key"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q key: %v", name, err)
		}
		key, err := pki.ParsePEMPrivateKey(keyBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q key: %v", name, err)
		}

		keystore.keys[name] = keystoreEntry{
			certificate: certificate,
			key:         key,
		}
	}

	var keypairIDs map[string]string
	keypairIDsBytes, err := os.ReadFile(path.Join(basePath, "keypair-ids.yaml"))
	if err != nil {
		return nil, nil, fmt.Errorf("reading keypair-ids.yaml")
	}
	if err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure <name>.key exists next to <name>.crt in the CABasePath
2. Fix file permissions so kops-controller can read the key
3. Regenerate the keypair if the key was lost

When it happens

Trigger: Thrown at cmd/kops-controller/pkg/server/keystore.go:96 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6af735a568aa7bb7. Report an issue: GitHub.