kubernetes/kops · error

unable to get cluster keystore: %v

Error message

unable to get cluster keystore: %v

What it means

After finding the cluster, buildCredentials calls clientset.KeyStore(cluster) to get the key store backing cluster secrets (where the kOps CA lives). An error here is wrapped as 'unable to get cluster keystore'. This indicates the state-store backend couldn't be initialized or the cluster's config is unreadable, not that credentials are wrong.

Source

Thrown at pkg/commands/helpers/kubectl_auth.go:245

func buildCredentials(ctx context.Context, f *util.Factory, options *HelperKubectlAuthOptions) (*ExecCredentialStatus, error) {
	clientset, err := f.KopsClient()
	if err != nil {
		return nil, err
	}

	cluster, err := clientset.GetCluster(ctx, options.ClusterName)
	if err != nil {
		return nil, err
	}

	if cluster == nil {
		return nil, fmt.Errorf("cluster not found %q", options.ClusterName)
	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return nil, fmt.Errorf("unable to get cluster keystore: %v", err)
	}

	cn := "kubecfg"
	user, err := user.Current()
	if err != nil || user == nil {
		klog.Infof("unable to get user: %v", err)
	} else {
		cn += "-" + user.Name
	}

	req := pki.IssueCertRequest{
		Signer: fi.CertificateIDCA,
		Type:   "client",
		Subject: pkix.Name{
			CommonName: cn,

			Organization: []string{rbac.SystemPrivilegedGroup},
		},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check cloud credentials: run `kops get cluster <name>` to confirm state-store access works.
2. Verify KOPS_STATE_STORE and region/profile env vars (AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, etc.).
3. Inspect the cluster manifest in the state store for a missing/invalid keyStore (kops uses the default keyStore unless configured otherwise); re-export or repair the cluster config.

Example fix

// before
$ kops helpers kubectl-auth --cluster c  # no AWS creds
// after
$ export AWS_PROFILE=prod
$ kops helpers kubectl-auth --cluster c

// confirm state-store access before invoking the helper
if err := exec.Command("kops", "get", "cluster", clusterName).Run(); err != nil {
    return fmt.Errorf("state store unreachable or misconfigured: %v", err)
}

err := helpers.RunKubectlAuthHelper(ctx, f, out, options)
if err != nil && strings.Contains(err.Error(), "unable to get cluster keystore") {
    // refresh cloud credentials and retry once
    if refreshCloudCredentials() == nil {
        err = helpers.RunKubectlAuthHelper(ctx, f, out, options)
    }
}

When it happens

Trigger: clientset.KeyStore(cluster) fails: state store backend inaccessible (S3/GCS credentials missing or expired), state store configuration invalid for the cluster object, or unsupported/legacy keyStore configuration in the cluster manifest.

Common situations: Expired or absent AWS credentials / AWS_PROFILE mismatch; VFS permissions on the S3 bucket; KOPS_STATE_STORE misconfigured or migrated; corrupted cluster manifest missing secret configuration.

Related errors

• reading existing keyset: %v
• error storing user provided keys %q %q: %v
• error listing Keysets: %v
• listing keysets: %v
• reading keyset: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d46618776950d502. Report an issue: GitHub.