{"record":{"id":"68c198f3b28e4441","repo":"kubernetes/kops","slug":"error-replacing-sshcredential-v","errorCode":null,"errorMessage":"error replacing SSHCredential: %v","messagePattern":"error replacing SSHCredential: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/replace.go","lineNumber":219,"sourceCode":"\t\t\t\t}\n\t\t\t\tif v.Spec.PublicKey == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"spec.PublicKey is required\")\n\t\t\t\t}\n\n\t\t\t\tcluster, err := clientset.GetCluster(ctx, clusterName)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshKeyArr := []byte(v.Spec.PublicKey)\n\t\t\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error replacing SSHCredential: %v\", err)\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\tklog.V(2).Infof(\"Type of object was %T\", v)\n\t\t\t\treturn fmt.Errorf(\"unhandled kind %q in %q\", gvk, f)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":201,"sourceCodeEnd":230,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/replace.go#L201-L230","documentation":"After resolving the cluster, `kops replace` obtains the cluster's SSH credential store and calls AddSSHPublicKey with the manifest's public key bytes. This error wraps any failure from that store operation — the key was not persisted.","triggerScenarios":"sshCredentialStore.AddSSHPublicKey returns an error: backend failure writing to the key store (state store / keystore implementation), permission denied, or network failure to the backing service.","commonSituations":"State store backend outage or throttling; insufficient IAM/bucket permissions to write SSH credentials; cluster resolved via a misconfigured KOPS_STATE_STORE; stale credentials on the machine running kops.","solutions":["Read the wrapped %v error to identify the backend cause.","Verify state store access and write permissions for SSH credentials.","Re-authenticate cloud credentials and retry if transient.","Confirm the cluster name is correct — the store is cluster-scoped and a wrong name may point to a non-writable location."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Confirm write access to the state store before credential changes\nif _, err := os.Stat(kopsStatePath); err != nil {\n    return fmt.Errorf(\"cannot access state store: %v\", err)\n}\n// and confirm cloud creds: aws sts get-caller-identity","typeGuard":null,"tryCatchPattern":"if strings.HasPrefix(err.Error(), \"error replacing SSHCredential:\") {\n    // backend write failed: refresh creds, then retry once\n    refreshCloudCreds()\n    return retryAddSSHPublicKey(ctx, key)\n}","preventionTips":["Verify cloud credentials and state-store write permissions before credential operations","Confirm the cluster name matches an existing cluster","Add a single retry with backoff for transient store errors","Avoid running credential updates during provider incidents"],"tags":["kops","sshcredential","state-store","write-failure"],"backgroundTag":"credential-store-write-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}