{"record":{"id":"69ea98fc13c9d9aa","repo":"kubernetes/kops","slug":"unsupported-public-key-type-for-service-account","errorCode":null,"errorMessage":"unsupported public key type for service-account: %T","messagePattern":"unsupported public key type for service-account: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/discovery_service.go","lineNumber":154,"sourceCode":"\t\t\t// }\n\n\t\t\t// hasher := crypto.SHA256.New()\n\t\t\t// hasher.Write(publicKeyDERBytes)\n\t\t\t// publicKeyDERHash := hasher.Sum(nil)\n\n\t\t\t// jwk.KeyID = base64.RawURLEncoding.EncodeToString(publicKeyDERHash)\n\t\t}\n\n\t\tswitch publicKey := publicKey.(type) {\n\t\tcase *rsa.PublicKey:\n\t\t\tjwk.Algorithm = \"RS256\"\n\t\t\tjwk.Use = \"sig\"\n\t\t\tjwk.N = base64.RawURLEncoding.EncodeToString(publicKey.N.Bytes())\n\t\t\tjwk.E = base64.RawURLEncoding.EncodeToString(uint64ToBytes(uint64(publicKey.E)))\n\t\t\tjwk.KeyType = \"RSA\"\n\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unsupported public key type for service-account: %T\", publicKey)\n\t\t}\n\n\t\tjwks = append(jwks, jwk)\n\t}\n\tsort.Slice(jwks, func(i, j int) bool {\n\t\treturn jwks[i].KeyID < jwks[j].KeyID\n\t})\n\n\treturn jwks, nil\n}\n\nfunc uint64ToBytes(n uint64) []byte {\n\tdata := make([]byte, 8)\n\tbinary.BigEndian.PutUint64(data, n)\n\treturn bytes.TrimLeft(data, \"\\x00\")\n}\n","sourceCodeStart":136,"sourceCodeEnd":171,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/discovery_service.go#L136-L171","documentation":"Type guard in findJWKSForServiceAccount: the service-account signing key fetched from the secret store is not an *rsa.PublicKey (only RSA keys are supported for building the JWKS), so a key JSON web key cannot be produced.","triggerScenarios":"Thrown at nodeup/pkg/model/discovery_service.go:154 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the service-account keypair as RSA","Check the service-account secret in the state store","Rotate with kops create secret"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}