{"record":{"id":"9ac61c181132cd16","repo":"kubernetes/kops","slug":"error-adding-ssh-public-key-v-9ac61c","errorCode":null,"errorMessage":"error adding SSH public key: %v","messagePattern":"error adding SSH public key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/update_cluster.go","lineNumber":302,"sourceCode":"\t\treturn results, err\n\t}\n\n\tsecretStore, err := clientset.SecretStore(cluster)\n\tif err != nil {\n\t\treturn results, err\n\t}\n\n\tif c.SSHPublicKey != \"\" {\n\t\tfmt.Fprintf(out, \"--ssh-public-key on update is deprecated - please use `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub` instead\\n\", cluster.ObjectMeta.Name)\n\n\t\tc.SSHPublicKey = utils.ExpandPath(c.SSHPublicKey)\n\t\tauthorized, err := os.ReadFile(c.SSHPublicKey)\n\t\tif err != nil {\n\t\t\treturn results, fmt.Errorf(\"error reading SSH key file %q: %v\", c.SSHPublicKey, err)\n\t\t}\n\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, authorized)\n\t\tif err != nil {\n\t\t\treturn results, fmt.Errorf(\"error adding SSH public key: %v\", err)\n\t\t}\n\n\t\tklog.Infof(\"Using SSH public key: %v\\n\", c.SSHPublicKey)\n\t}\n\n\tvar phase cloudup.Phase\n\tif c.Phase != \"\" {\n\t\tswitch strings.ToLower(c.Phase) {\n\t\tcase string(cloudup.PhaseNetwork):\n\t\t\tphase = cloudup.PhaseNetwork\n\t\tcase string(cloudup.PhaseSecurity), \"iam\": // keeping IAM for backwards compatibility\n\t\t\tphase = cloudup.PhaseSecurity\n\t\tcase string(cloudup.PhaseCluster):\n\t\t\tphase = cloudup.PhaseCluster\n\t\tdefault:\n\t\t\treturn results, fmt.Errorf(\"unknown phase %q, available phases: %s\", c.Phase, strings.Join(cloudup.Phases.List(), \",\"))\n\t\t}\n\t}","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/update_cluster.go#L284-L320","documentation":"After successfully reading the file given by --ssh-public-key, `kops update cluster` adds it to the cluster's SSH credential store via AddSSHPublicKey. If that backend write fails, the error is surfaced as `error adding SSH public key: %v`. The key was read fine but could not be persisted to the cluster secrets backend.","triggerScenarios":"AddSSHPublicKey fails: underlying secret store unavailable or unwritable (S3/GCS/etcd backend errors, permission denied), SSH key rejected (empty file, invalid format), or concurrency conflict updating the secret.","commonSituations":"State-store credentials expired mid-run; SSH key file accidentally empty; bucket/KMS permissions changed; cluster locked by another concurrent kops operation.","solutions":["Inspect the wrapped error for the backend cause; fix credentials/permissions and retry","Verify the key file contains a valid one-line OpenSSH public key","Use `kops create secret sshpublickey admin -i <file>` directly to isolate and diagnose the store error","Ensure no concurrent kops command holds the cluster update lock"],"exampleFix":"// before\nauthorized=\"\"  # accidentally truncated file\nkops update cluster c.k8s.local --ssh-public-key ./admin.pub --yes\n// after\nssh-keygen -y -f ~/.ssh/id_ed25519 > ./admin.pub   # regenerate valid key\nkops update cluster c.k8s.local --ssh-public-key ./admin.pub --yes","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(utils.ExpandPath(keyPath))\nif err != nil || len(bytes.TrimSpace(data)) == 0 {\n\treturn fmt.Errorf(\"SSH public key %q is empty or unreadable\", keyPath)\n}\nif _, _, _, _, err := ssh.ParseAuthorizedKey(data); err != nil {\n\treturn fmt.Errorf(\"%q is not a valid OpenSSH public key\", keyPath)\n}\n// safe to call update / AddSSHPublicKey","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the key parses with golang.org/x/crypto/ssh before storing","Ensure the state-store backend is writable (credentials, IAM, KMS) beforehand","Avoid concurrent kops secret mutations","Regenerate keys with ssh-keygen if a file is truncated or corrupted"],"tags":["cli","ssh","secrets","persistence"],"backgroundTag":"ssh-key-store-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}