{"record":{"id":"5670311ca5f4765a","repo":"kubernetes/kops","slug":"ssh-agent-has-no-keys","errorCode":null,"errorMessage":"SSH agent has no keys","messagePattern":"SSH agent has no keys","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":311,"sourceCode":"\tsocket := os.Getenv(\"SSH_AUTH_SOCK\")\n\tif socket == \"\" {\n\t\treturn nil, fmt.Errorf(\"cannot connect to SSH agent; SSH_AUTH_SOCK env variable not set\")\n\t}\n\tconn, err := net.Dial(\"unix\", socket)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to connect to SSH agent with SSH_AUTH_SOCK %q: %w\", socket, err)\n\t}\n\n\tagentClient := agent.NewClient(conn)\n\n\tsigners, err := agentClient.Signers()\n\tif err != nil {\n\t\t_ = conn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to get signers: %w\", err)\n\t}\n\n\tif len(signers) == 0 {\n\t\treturn nil, fmt.Errorf(\"SSH agent has no keys\")\n\t}\n\n\tsshConfig := &ssh.ClientConfig{\n\t\tHostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {\n\t\t\tklog.Warningf(\"accepting SSH key %v for %q\", key, hostname)\n\t\t\treturn nil\n\t\t},\n\t\tAuth: []ssh.AuthMethod{\n\t\t\t// Use a callback rather than PublicKeys so we only consult the\n\t\t\t// agent once the remote server wants it.\n\t\t\tssh.PublicKeysCallback(agentClient.Signers),\n\t\t},\n\t\tUser: sshUser,\n\t}\n\t// Use net.JoinHostPort so that IPv6 addresses are bracketed correctly.\n\tsshClient, err := ssh.Dial(\"tcp\", net.JoinHostPort(host, strconv.Itoa(sshPort)), sshConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to SSH to %q (with user %q): %w\", host, sshUser, err)","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L293-L329","documentation":"The connected ssh-agent returned zero signers: the agent socket is reachable but no identities are loaded (ssh-add -l is empty), so there is no key available to authenticate to the target host.","triggerScenarios":"agentClient.Signers() returns an empty slice: the agent is running (often freshly started) but ssh-add was never run, or all keys were removed (ssh-add -D), or the forwarded agent belongs to a user/machine with no keys loaded.","commonSituations":"Starting a new CI job with an agent but forgetting to inject the key; ssh-add keys on a laptop then hopping through a bastion without forwarding; reboot cleared the agent's key cache.","solutions":["Add a key to the agent: ssh-add ~/.ssh/id_<type>","Confirm keys are loaded: ssh-add -l (should list at least one key)","If re-running after failure, ensure a prior ssh-add -D wasn't executed or the agent restarted","Test SSH manually first: ssh <user>@<host> should succeed using the same agent"],"exampleFix":"// before\n$ eval $(ssh-agent)\n$ kops toolbox enroll ...  # Error: SSH agent has no keys\n// after\n$ eval $(ssh-agent)\n$ ssh-add ~/.ssh/id_ed25519\n$ ssh-add -l   # sanity check: lists the key\n$ kops toolbox enroll ...","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"ssh-add\", \"-l\").Output()\nif err != nil || len(bytes.TrimSpace(out)) == 0 {\n    return fmt.Errorf(\"no keys in agent; run ssh-add <key>\")\n}","typeGuard":"func agentHasKeys() bool {\n    out, err := exec.Command(\"ssh-add\", \"-l\").Output()\n    return err == nil && len(bytes.TrimSpace(out)) > 0\n}","tryCatchPattern":"host, err := NewSSHHost(ctx, hostAddr, port, user, sudo)\nif err != nil && strings.Contains(err.Error(), \"SSH agent has no keys\") {\n    return fmt.Errorf(\"load a key first: ssh-add ~/.ssh/id_ed25519\")\n}","preventionTips":["Run ssh-add -l as a preflight before enroll","Add keys after every fresh eval $(ssh-agent)","In CI, provision keys into the agent in the setup step"],"tags":["ssh","ssh-agent","authentication"],"backgroundTag":"ssh-agent-no-keys","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}