{"record":{"id":"14aea26cd44e01df","repo":"kubernetes/kops","slug":"unexpected-key-type-q","errorCode":null,"errorMessage":"unexpected key type %q","messagePattern":"unexpected key type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/server.go","lineNumber":296,"sourceCode":"\t\t\tw.WriteHeader(http.StatusBadRequest)\n\t\t\t_, _ = fmt.Fprintf(w, \"failed to issue %q: %v\", name, err)\n\t\t\treturn\n\t\t}\n\t\tresp.Certs[name] = cert\n\t}\n\n\tw.Header().Set(\"Content-Type\", \"application/json\")\n\t_ = json.NewEncoder(w).Encode(resp)\n\tklog.Infof(\"bootstrap %s (req.includeNodeConfig: %t, req.certs.#: %d, req.keypairs.#: %d) success\", r.RemoteAddr, req.IncludeNodeConfig, len(req.Certs), len(req.KeypairIDs))\n}\n\nfunc (s *Server) issueCert(ctx context.Context, name string, pubKey string, id *bootstrap.VerifyResult, validHours uint32, keypairIDs map[string]string) (string, error) {\n\tblock, _ := pem.Decode([]byte(pubKey))\n\tif block == nil {\n\t\treturn \"\", fmt.Errorf(\"decoding pem public key\")\n\t}\n\tif block.Type != \"RSA PUBLIC KEY\" {\n\t\treturn \"\", fmt.Errorf(\"unexpected key type %q\", block.Type)\n\t}\n\tkey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing key: %v\", err)\n\t}\n\n\tissueReq := &pki.IssueCertRequest{\n\t\tSigner:    fi.CertificateIDCA,\n\t\tType:      \"client\",\n\t\tPublicKey: key,\n\t\tValidity:  time.Hour * time.Duration(validHours),\n\t}\n\n\tif !s.certNames.Has(name) {\n\t\treturn \"\", fmt.Errorf(\"key name not enabled\")\n\t}\n\tswitch name {\n\tcase \"etcd-client-cilium\":","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/server.go#L278-L314","documentation":"issueCert only accepts PEM blocks of type \"RSA PUBLIC KEY\". This error is thrown when the decoded block has a different type (e.g. PUBLIC KEY, EC PUBLIC KEY), meaning the client submitted a key type this endpoint does not accept.","triggerScenarios":"Bootstrap request pubKey decodes to a PEM block whose Type is not exactly \"RSA PUBLIC KEY\" — e.g. a PKIX \"PUBLIC KEY\" block, an EC/Ed25519 key, or a private key.","commonSituations":"Node generating an ECDSA or ED25519 key instead of RSA; sending a public key in SPKI (\"PUBLIC KEY\") format rather than PKCS#1; template or nodeup script customized to use different key algorithms.","solutions":["Generate an RSA key on the node and encode it as PKCS#1 (RSA PUBLIC KEY)","Use x509.MarshalPKCS1PublicKey with Type \"RSA PUBLIC KEY\" when PEM-encoding","Align nodeup/client key-generation code with kops-controller's expectation","Verify no custom patches switched the key algorithm"],"exampleFix":"// before\nblock := &pem.Block{Type: \"PUBLIC KEY\", Bytes: derBytes}\n// after\nblock := &pem.Block{Type: \"RSA PUBLIC KEY\", Bytes: x509.MarshalPKCS1PublicKey(rsaKey)}","handlingStrategy":"type-guard","validationCode":"if block.Type != \"RSA PUBLIC KEY\" {\n    return fmt.Errorf(\"expected RSA PUBLIC KEY, got %q\", block.Type)\n}","typeGuard":"func isRSAPublicKeyPEM(pub string) bool {\n    b, _ := pem.Decode([]byte(pub))\n    return b != nil && b.Type == \"RSA PUBLIC KEY\"\n}","tryCatchPattern":"if block.Type != \"RSA PUBLIC KEY\" {\n    return \"\", fmt.Errorf(\"unexpected key type %q\", block.Type)\n}","preventionTips":["Generate RSA keys on nodes; do not switch to ECDSA/Ed25519","Encode with x509.MarshalPKCS1PublicKey under Type \"RSA PUBLIC KEY\"","Document the accepted key format for custom bootstrap clients"],"tags":["go","rsa","pem","certificates","bootstrap"],"backgroundTag":"unsupported-key-type","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}