{"record":{"id":"652b0495f843f34c","repo":"kubernetes/kops","slug":"error-loading-private-key-q-v","errorCode":null,"errorMessage":"error loading private key %q: %v","messagePattern":"error loading private key %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":198,"sourceCode":"\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc createKeypair(ctx context.Context, out io.Writer, options *CreateKeypairOptions, name string, keyStore fi.CAStore) error {\n\tvar err error\n\tvar privateKey *pki.PrivateKey\n\tif options.PrivateKeyPath != \"\" {\n\t\toptions.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)\n\t\tprivateKeyBytes, err := os.ReadFile(options.PrivateKeyPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading user provided private key %q: %v\", options.PrivateKeyPath, err)\n\t\t}\n\n\t\tprivateKey, err = pki.ParsePEMPrivateKey(privateKeyBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading private key %q: %v\", privateKeyBytes, err)\n\t\t}\n\t}\n\n\tvar cert *pki.Certificate\n\tif options.CertPath == \"\" {\n\t\tif privateKey == nil {\n\t\t\tprivateKey, err = pki.GeneratePrivateKey()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error generating private key: %v\", err)\n\t\t\t}\n\t\t}\n\n\t\tserial := pki.BuildPKISerial(time.Now().UnixNano())\n\t\treq := pki.IssueCertRequest{\n\t\t\tType:       \"ca\",\n\t\t\tSubject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},\n\t\t\tSerial:     serial,\n\t\t\tPrivateKey: privateKey,","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L180-L216","documentation":"After a successful read of the user-supplied --key file, the bytes are parsed with pki.ParsePEMPrivateKey. Content that isn't a valid PEM private key (or an unsupported key algorithm) produces this error, which embeds the raw key bytes in the message.","triggerScenarios":"`--key <path>` where the file's contents fail pki.ParsePEMPrivateKey — non-PEM data, a public key instead of private, a certificate, encrypted PEM, or unsupported algorithm (cmd/kops/create_keypair.go:198).","commonSituations":"Passing the .crt/.pub file by mistake; passing an encrypted key with a passphrase (kOps won't prompt); keys in non-PEM formats (e.g. raw DER or PuTTY PPK); wrong key type for the keyset.","solutions":["Verify the file is an unencrypted PEM private key: `head -1 file` should show -----BEGIN ... PRIVATE KEY-----.","Decrypt first if needed: `openssl pkey -in encrypted.key -out decrypted.key`.","Ensure you pass the private key, not the certificate (--cert is the separate flag).","Convert non-PEM formats: `openssl rsa -inform DER -in key.der -out key.pem` (or export from PuTTYgen to OpenSSH PEM).","Check the algorithm is supported (e.g. RSA/ECDSA) for the target keyset."],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset ca --key ca.crt   # certificate, not a key\n// after\nkops create keypair cluster.k8s.local --keyset ca --cert ca.crt --key ca.key","handlingStrategy":"validation","validationCode":"grep -q '^-----BEGIN .*PRIVATE KEY-----$' \"$KEY_PATH\" || { echo \"$KEY_PATH is not a PEM private key\"; exit 1; }\nopenssl pkey -in \"$KEY_PATH\" -noout >/dev/null 2>&1 || { echo \"key unreadable/encrypted/unsupported\"; exit 1; }","typeGuard":null,"tryCatchPattern":"if ! out=$(kops create keypair \"$CLUSTER\" --keyset ca --key \"$KEY\" 2>&1); then\n  case \"$out\" in\n    *\"error loading private key\"*) echo \"Re-encode the key: openssl pkey -in \"$KEY\" -out key.pem\";;\n  esac\nfi","preventionTips":["Keep unencrypted PEM private keys for kOps use; decrypt or convert PPK/DER beforehand.","Don't confuse --key (private) with --cert (certificate) paths.","Sanity-check with `openssl pkey -in key -noout` before every rotation."],"tags":["pem","private-key","parsing","keypair","kops"],"backgroundTag":"invalid-pem-key","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}