{"record":{"id":"038e6f44c99d640e","repo":"kubernetes/kops","slug":"must-specify-q-label-with-cluster-name-to-create-038e6f","errorCode":null,"errorMessage":"must specify %q label with cluster name to create SSHCredential","messagePattern":"must specify %q label with cluster name to create SSHCredential","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create.go","lineNumber":182,"sourceCode":"\t\t\t\t}\n\n\t\t\t\tif cluster == nil {\n\t\t\t\t\treturn fmt.Errorf(\"cluster %q not found\", clusterName)\n\t\t\t\t}\n\n\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})\n\t\t\t\tif err != nil {\n\t\t\t\t\tif apierrors.IsAlreadyExists(err) {\n\t\t\t\t\t\treturn fmt.Errorf(\"instanceGroup %q already exists\", v.ObjectMeta.Name)\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"error creating instanceGroup: %v\", err)\n\t\t\t\t}\n\t\t\t\tfmt.Fprintf(&sb, \"Created instancegroup/%s\\n\", v.ObjectMeta.Name)\n\n\t\t\tcase *kopsapi.SSHCredential:\n\t\t\t\tclusterName = v.ObjectMeta.Labels[kopsapi.LabelClusterName]\n\t\t\t\tif clusterName == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"must specify %q label with cluster name to create SSHCredential\", kopsapi.LabelClusterName)\n\t\t\t\t}\n\t\t\t\tif v.Spec.PublicKey == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"spec.PublicKey is required\")\n\t\t\t\t}\n\n\t\t\t\tcluster, err := clientset.GetCluster(ctx, clusterName)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshKeyArr := []byte(v.Spec.PublicKey)\n\t\t\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)\n\t\t\t\tif err != nil {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create.go#L164-L200","documentation":"Same pattern as instance groups but for SSHCredential objects: RunCreate requires the `kops.k8s.io/cluster` (LabelClusterName) metadata label to route the credential to a cluster's SSH credential store; if absent the command returns this error.","triggerScenarios":"`kops create -f sshcred.yaml` where the kind: SSHCredential document lacks metadata.labels[\"kops.k8s.io/cluster\"], or the label key is misspelled so it reads as empty.","commonSituations":"Hand-written SSH credential manifests; automation emitting SSHCredential specs without ObjectMeta labels; docs examples predating the label requirement.","solutions":["Add `kops.k8s.io/cluster: <cluster-name>` to metadata.labels of the SSHCredential document","Alternatively upload the key with `kops create secret sshpublickey admin -f pubkey` targeting --name <cluster>","Verify the label key spelling matches kops.k8s.io/cluster"],"exampleFix":"# before\nkind: SSHCredential\nmetadata:\n  name: admin\n# after\nkind: SSHCredential\nmetadata:\n  name: admin\n  labels:\n    kops.k8s.io/cluster: mycluster.example.com","handlingStrategy":"validation","validationCode":"if v, ok := obj.(*kopsapi.SSHCredential); ok && v.ObjectMeta.Labels[kopsapi.LabelClusterName] == \"\" {\n    return fmt.Errorf(\"SSHCredential %s missing label %s\", v.Name, kopsapi.LabelClusterName)\n}","typeGuard":"func labeledSSHCredential(o runtime.Object) (*kopsapi.SSHCredential, bool) {\n    c, ok := o.(*kopsapi.SSHCredential)\n    return c, ok && c.ObjectMeta.Labels[kopsapi.LabelClusterName] != \"\"\n}","tryCatchPattern":null,"preventionTips":["Prefer `kops create secret sshpublickey` which handles labels implicitly","Template the cluster label into all SSHCredential manifests","Lint for required kops labels before create"],"tags":["kops","cli","ssh","missing-label"],"backgroundTag":"missing-required-label","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}