kubernetes/kops · error

the first keypair added to a keyset must be primary

Error message

the first keypair added to a keyset must be primary

What it means

kOps requires that the first keypair in a keyset be added as primary. This error is returned when `kops create keypair` finds no existing keyset for the given name but the command was invoked without --primary (options.Primary false), so a non-primary keypair cannot seed a brand-new keyset.

Source

Thrown at cmd/kops/create_keypair.go:243

		if err != nil {
			return fmt.Errorf("error reading user provided cert %q: %v", options.CertPath, err)
		}

		cert, err = pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return fmt.Errorf("error loading certificate %q: %v", options.CertPath, err)
		}
	}

	keyset, err := keyStore.FindKeyset(ctx, name)
	var item *fi.KeysetItem
	if os.IsNotExist(err) || (err == nil && keyset == nil) {
		if options.Primary {
			if keyset, err = fi.NewKeyset(cert, privateKey); err != nil {
				return err
			}
		} else {
			return fmt.Errorf("the first keypair added to a keyset must be primary")
		}
		item = keyset.Primary
	} else if err != nil {
		return fmt.Errorf("reading existing keyset: %v", err)
	} else {
		item, err = keyset.AddItem(cert, privateKey, options.Primary)
	}
	if err != nil {
		return err
	}

	err = keyStore.StoreKeyset(ctx, name, keyset)
	if err != nil {
		return fmt.Errorf("error storing user provided keys %q %q: %v", options.CertPath, options.PrivateKeyPath, err)
	}

	if options.CertPath != "" {
		fmt.Fprintf(out, "using user provided cert: %v\n", options.CertPath)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add the --primary flag: `kops create keypair <cluster> <keyset> --primary`.
2. Check the keyset name for typos (an existing keyset accepts a non-primary add).
3. Confirm you are pointed at the right cluster/state store where the keyset exists.
4. Create the keyset with a primary keypair before adding secondary ones.

Example fix

// before
kops create keypair cluster.example.com kubernetes-ca
// error: the first keypair added to a keyset must be primary
// after
kops create keypair cluster.example.com kubernetes-ca --primary

// Pre-check whether the keyset exists before invoking with a non-primary add
keyset, err := keyStore.FindKeyset(ctx, name)
exists := err == nil && keyset != nil
if !exists && !primaryFlag {
    return errors.New("keyset does not exist: must pass --primary")
}

if err != nil && strings.Contains(err.Error(), "first keypair added to a keyset must be primary") {
    // re-run the command with --primary
}

When it happens

Trigger: Running `kops create keypair <cluster> <keyset>` where FindKeyset returns not-exist/nil and options.Primary is false — i.e. targeting a keyset that doesn't exist yet without the primary flag.

Common situations: Typo in the keyset name so it looks brand-new; intending to add a secondary keypair but the keyset was never created or lives in a different state store/cluster; forgetting --primary on first bootstrap.

Related errors

• error getting keystore: %v
• promoting keypair for %s: %v
• keypair has no private key
• keypair has no certificate
• keypair not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b2d4f531392f63c2. Report an issue: GitHub.