{"record":{"id":"69a2615229779944","repo":"kubernetes/kops","slug":"spec-publickey-is-required","errorCode":null,"errorMessage":"spec.PublicKey is required","messagePattern":"spec\\.PublicKey is required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create.go","lineNumber":185,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"cluster %q not found\", clusterName)\n\t\t\t\t}\n\n\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})\n\t\t\t\tif err != nil {\n\t\t\t\t\tif apierrors.IsAlreadyExists(err) {\n\t\t\t\t\t\treturn fmt.Errorf(\"instanceGroup %q already exists\", v.ObjectMeta.Name)\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"error creating instanceGroup: %v\", err)\n\t\t\t\t}\n\t\t\t\tfmt.Fprintf(&sb, \"Created instancegroup/%s\\n\", v.ObjectMeta.Name)\n\n\t\t\tcase *kopsapi.SSHCredential:\n\t\t\t\tclusterName = v.ObjectMeta.Labels[kopsapi.LabelClusterName]\n\t\t\t\tif clusterName == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"must specify %q label with cluster name to create SSHCredential\", kopsapi.LabelClusterName)\n\t\t\t\t}\n\t\t\t\tif v.Spec.PublicKey == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"spec.PublicKey is required\")\n\t\t\t\t}\n\n\t\t\t\tcluster, err := clientset.GetCluster(ctx, clusterName)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshKeyArr := []byte(v.Spec.PublicKey)\n\t\t\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\tfmt.Fprintf(&sb, \"Added ssh credential\\n\")","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create.go#L167-L203","documentation":"For SSHCredential objects, besides the cluster label, kOps requires spec.publicKey to contain the actual SSH public key material. An SSHCredential with an empty spec.publicKey cannot be stored, so RunCreate rejects it with this error.","triggerScenarios":"`kops create -f sshcred.yaml` where the SSHCredential document has `spec: {}` or `spec.publicKey: \"\"` — e.g. the key was templated out, the file was truncated, or a placeholder was never substituted.","commonSituations":"CI secret-injection failure leaving the publicKey field empty; YAML generated by a script that skipped embedding the key; copying an example manifest that omitted the key body.","solutions":["Populate spec.publicKey with the SSH public key text (e.g. `ssh-rsa AAAA... user@host`)","Use `kops create secret sshpublickey admin -f ~/.ssh/id_rsa.pub --name <cluster>` instead","Check templating/CI variable substitution produced a non-empty key"],"exampleFix":"# before\nspec:\n  publicKey: \"\"\n# after\nspec:\n  publicKey: \"ssh-rsa AAAAB3Nza... me@laptop\"","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(sshCred.Spec.PublicKey) == \"\" {\n    return fmt.Errorf(\"spec.publicKey must contain key material\")\n}\nif !strings.HasPrefix(sshCred.Spec.PublicKey, \"ssh-\") {\n    return fmt.Errorf(\"spec.publicKey does not look like an SSH public key\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Read the key from a file at render time rather than inlining templates","Fail CI early if the secret variable backing the key is empty","Sanity-check the key starts with ssh-rsa/ssh-ed25519/ecdsa-"],"tags":["kops","cli","ssh","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}