{"record":{"id":"9713adf2da66ac0e","repo":"kubernetes/kops","slug":"error-listing-sshcredentials-v","errorCode":null,"errorMessage":"error listing SSHCredentials: %v","messagePattern":"error listing SSHCredentials: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":345,"sourceCode":"\n\treturn c.deleteSSHCredential(ctx)\n}\n\nfunc (c *ClientsetCAStore) MirrorTo(ctx context.Context, basedir vfs.Path) error {\n\tkeysets, err := c.ListKeysets()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor name, keyset := range keysets {\n\t\tif err := mirrorKeyset(ctx, c.cluster, basedir, name, keyset); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tsshCredentials, err := c.FindSSHPublicKeys()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error listing SSHCredentials: %v\", err)\n\t}\n\n\tfor _, sshCredential := range sshCredentials {\n\t\tif err := mirrorSSHCredential(ctx, c.cluster, basedir, sshCredential); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":327,"sourceCodeEnd":356,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L327-L356","documentation":"MirrorTo mirrors keysets and SSH credentials from the API-store-backed CAStore to a filesystem-basedir. When FindSSHPublicKeys fails, the error is re-wrapped as 'error listing SSHCredentials: %v', so the underlying cause is usually the FindSSHPublicKeys read error (see 1826).","triggerScenarios":"Any operation that mirrors the state store (e.g. kOps commands reading config via MirrorTo) where the SSHCredential Get fails with a non-NotFound error: RBAC denial, API outage, timeouts.","commonSituations":"kops commands run against clusters with degraded API server access; CI jobs with restricted service accounts reading cluster state; mirroring to an external state store while API access is intermittent.","solutions":["Fix the underlying FindSSHPublicKeys error first (RBAC or connectivity)","Verify service account permissions for sshcredentials.kops.k8s.io in CI","Retry mirroring if the cause was a transient API server error","If no SSH keys are needed, note that a clean 404 is tolerated — only real errors block mirroring"],"exampleFix":"// before\nif err := store.MirrorTo(ctx, basedir); err != nil { return err }\n// after\nif err := store.MirrorTo(ctx, basedir); err != nil {\n\tif strings.Contains(err.Error(), \"timeout\") {\n\t\treturn store.MirrorTo(ctx, basedir) // one retry for transient API issues\n\t}\n\treturn err\n}","handlingStrategy":"retry","validationCode":"// probe mirror precondition: can we read ssh credentials?\nif _, err := clientset.SSHCredentials(ns).Get(ctx, \"admin\", metav1.GetOptions{}); err != nil && !apierrors.IsNotFound(err) {\n\treturn fmt.Errorf(\"mirror precondition failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := store.MirrorTo(ctx, basedir); err != nil {\n\tif strings.Contains(err.Error(), \"error listing SSHCredentials\") {\n\t\t// transient API issue: retry once\n\t\ttime.Sleep(2 * time.Second)\n\t\treturn store.MirrorTo(ctx, basedir)\n\t}\n\treturn err\n}","preventionTips":["Fix underlying FindSSHPublicKeys errors (1826) first","Ensure CI service accounts can read sshcredentials.kops.k8s.io","Run mirroring when API server health checks pass","Remember clean NotFound is tolerated; only real errors break mirroring"],"tags":["kubernetes","ssh","mirror","rbac"],"backgroundTag":"kubernetes-api-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}