{"record":{"id":"4680509611c35ab0","repo":"kubernetes/kops","slug":"unknown-format-for-private-key-q","errorCode":null,"errorMessage":"unknown format for private key: %q","messagePattern":"unknown format for private key: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/privatekey.go","lineNumber":132,"sourceCode":"\t\t\td, err2 := base64.StdEncoding.DecodeString(s)\n\t\t\tif err2 == nil {\n\t\t\t\tr2, err2 := parsePEMPrivateKey(d)\n\t\t\t\tif err2 == nil {\n\t\t\t\t\tklog.Warningf(\"used base64 decode of PrivateKey\")\n\t\t\t\t\tr = r2\n\t\t\t\t\terr = nil\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error parsing private key: %v\", err)\n\t\t\t}\n\t\t}\n\t\tk.Key = r\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"unknown format for private key: %q\", string(b))\n}\n\nfunc (k *PrivateKey) MarshalJSON() ([]byte, error) {\n\tvar data bytes.Buffer\n\t_, err := k.WriteTo(&data)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error writing SSL private key: %v\", err)\n\t}\n\treturn json.Marshal(data.String())\n}\n\nvar _ io.WriterTo = &PrivateKey{}\n\nfunc (k *PrivateKey) WriteTo(w io.Writer) (int64, error) {\n\tif k.Key == nil {\n\t\t// For the dry-run case\n\t\treturn 0, nil\n\t}","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/privatekey.go#L114-L150","documentation":"PrivateKey.UnmarshalJSON expects the JSON value to be a string (PEM or base64-encoded PEM). If json.Unmarshal into a string fails, the library has no other supported representation and returns 'unknown format for private key' quoting the raw JSON bytes.","triggerScenarios":"Feeding UnmarshalJSON a JSON object, array, number, or null instead of a string — e.g. the key stored as {\"data\": ...} in the state store, or a field that got double-encoded/unexpectedly typed.","commonSituations":"Migrating cluster state between kops versions or tools that serialize keys as objects; accidental quoting mistakes producing raw non-string JSON; generating spec files programmatically and marshaling a map instead of the key string.","solutions":["Ensure the JSON value for the key field is a double-quoted string containing the PEM text (newlines escaped as \\n).","If your source is a raw key file, marshal it as a string first: json.Marshal(string(pemBytes)).","Check the producer of the JSON (state store, template) for changed serialization format between versions."],"exampleFix":"// before\njson.Unmarshal(b, &k) with b = '{\"pem\": \"-----BEGIN...\"}'\n// after\nb, _ := json.Marshal(string(pemBytes)) // \"-----BEGIN RSA PRIVATE KEY-----\\n...\"\njson.Unmarshal(b, &k)","handlingStrategy":"validation","validationCode":"var s string\nif err := json.Unmarshal(b, &s); err != nil {\n    return fmt.Errorf(\"private key JSON must be a string, got: %s\", string(b))\n}","typeGuard":null,"tryCatchPattern":"if err := json.Unmarshal(b, &spec); err != nil {\n    if strings.Contains(err.Error(), \"unknown format for private key\") {\n        // producer emitted a non-string JSON value for the key field\n    }\n    return err\n}","preventionTips":["Always marshal keys as plain JSON strings (json.Marshal(string(pemBytes))).","Check the version of the tool writing the state store when format errors appear after a migration.","Validate JSON schema of generated specs before applying them."],"tags":["pki","json","deserialization"],"backgroundTag":"schema-validation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}