{"record":{"id":"b22ff54cf39880ae","repo":"kubernetes/kops","slug":"creating-ssh-session-w","errorCode":null,"errorMessage":"creating ssh session: %w","messagePattern":"creating ssh session: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/dump/dumper.go","lineNumber":712,"sourceCode":"\n\tvar client *ssh.Client\n\tfinished := make(chan error)\n\tgo func() {\n\t\tc, chans, reqs, err := ssh.NewClientConn(conn, addr, f.sshConfig)\n\t\tif err == nil {\n\t\t\tclient = ssh.NewClient(c, chans, reqs)\n\t\t\tif useBastion {\n\t\t\t\terr = agent.ForwardToAgent(client, f.keyRing)\n\t\t\t\tif err != nil {\n\t\t\t\t\terr = fmt.Errorf(\"forwarding ssh auth to keyring: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif err == nil && useBastion {\n\t\t\tsession, err := client.NewSession()\n\t\t\tif err != nil {\n\t\t\t\tfinished <- fmt.Errorf(\"creating ssh session: %w\", err)\n\t\t\t\treturn\n\t\t\t}\n\t\t\tdefer session.Close()\n\n\t\t\terr = agent.RequestAgentForwarding(session)\n\t\t\tif err != nil {\n\t\t\t\tfinished <- fmt.Errorf(\"requesting agent forwarding: %w\", err)\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tfinished <- err\n\t}()\n\n\tselect {\n\tcase <-ctx.Done():\n\t\tklog.Infof(\"cancelling SSH tcp connection due to context completion\")\n\t\tconn.Close() // Close the TCP connection to force cancellation","sourceCodeStart":694,"sourceCodeEnd":730,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/dump/dumper.go#L694-L730","documentation":"After forwarding the agent, Dial opens an SSH session on the bastion connection with client.NewSession(); failure is reported to the finished channel wrapped with this message. The error means the SSH client connection exists but a new session channel could not be created — usually because the connection dropped or the server rejected the session.","triggerScenarios":"client.NewSession() fails inside the Dial goroutine when useBastion=true, after ForwardToAgent succeeded — connection to bastion reset/closed, server-side session limits (MaxSessions), or server refusing new channels.","commonSituations":"Bastion sshd hitting MaxSessions limits during concurrent dumps; bastion restarting mid-dump; sshd config restricting session channels; transient network interruption right after handshake.","solutions":["Retry the Dial after confirming the bastion is healthy (ssh user@bastion works)","Reduce concurrent SSH sessions to the bastion or raise sshd MaxSessions on the bastion host","Check bastion sshd logs and instance state; recreate the bastion instance if it is wedged","Increase context timeout / add backoff-retry around the dump operation for transient drops"],"exampleFix":"// before\nclient, err := factory.Dial(ctx, host, true)\n\n// after\nvar client sshClient\nerr = wait.PollImmediate(5*time.Second, 2*time.Minute, func() (bool, error) {\n\tvar e error\n\tclient, e = factory.Dial(ctx, host, true)\n\treturn e == nil, nil\n})","handlingStrategy":"retry","validationCode":"var ok bool\nfor i := 0; i < 3; i++ {\n\tc, e := net.DialTimeout(\"tcp\", net.JoinHostPort(bastion, \"22\"), 3*time.Second)\n\tif e == nil {\n\t\tc.Close()\n\t\tok = true\n\t\tbreak\n\t}\n\ttime.Sleep(2 * time.Second)\n}\nif !ok {\n\treturn fmt.Errorf(\"bastion %s not accepting sessions\", bastion)\n}","typeGuard":"func isSessionError(err error) bool { return strings.Contains(err.Error(), \"creating ssh session\") }","tryCatchPattern":"client, err := factory.Dial(ctx, host, true)\nif err != nil && strings.Contains(err.Error(), \"creating ssh session\") {\n\t// transient: back off and retry\n\ttime.Sleep(5 * time.Second)\n\tclient, err = factory.Dial(ctx, host, true)\n}","preventionTips":["Limit concurrent SSH sessions to the bastion or raise sshd MaxSessions","Add retry with backoff around Dial for transient session failures","Monitor bastion health (instance status, sshd) before bulk dumps"],"tags":["ssh","session","bastion","transient"],"backgroundTag":"ssh-session-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}