{"record":{"id":"b2934972fb337e04","repo":"kubernetes/kops","slug":"spec-publickey-is-required-b29349","errorCode":null,"errorMessage":"spec.PublicKey is required","messagePattern":"spec\\.PublicKey is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/replace.go","lineNumber":203,"sourceCode":"\t\t\t\tcase nil:\n\t\t\t\t\tklog.Infof(\"instanceGroup: %v was not found, creating resource now\", igName)\n\t\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"error creating instanceGroup: %v\", err)\n\t\t\t\t\t}\n\t\t\t\tdefault:\n\t\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Update(ctx, v, metav1.UpdateOptions{})\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"error replacing instanceGroup: %v\", err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tcase *kopsapi.SSHCredential:\n\t\t\t\tclusterName := v.ObjectMeta.Labels[kopsapi.LabelClusterName]\n\t\t\t\tif clusterName == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"must specify %q label with cluster name to replace SSHCredential\", kopsapi.LabelClusterName)\n\t\t\t\t}\n\t\t\t\tif v.Spec.PublicKey == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"spec.PublicKey is required\")\n\t\t\t\t}\n\n\t\t\t\tcluster, err := clientset.GetCluster(ctx, clusterName)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshKeyArr := []byte(v.Spec.PublicKey)\n\t\t\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error replacing SSHCredential: %v\", err)\n\t\t\t\t}\n\t\t\tdefault:","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/replace.go#L185-L221","documentation":"An SSHCredential manifest must carry the public key in spec.publicKey. `kops replace` validates this before contacting the credential store; an empty Spec.PublicKey means there is nothing to add, so the command fails fast with this message.","triggerScenarios":"Applying an SSHCredential YAML where `spec.publicKey` is empty, omitted, or contains only whitespace (the byte conversion yields an empty key).","commonSituations":"Templating mistake that drops the key field; piping a file that failed to load; writing `publicKey: \"\"` placeholder and forgetting to fill it; YAML indentation placing the key under the wrong field.","solutions":["Set spec.publicKey to the full OpenSSH public key string (e.g. `ssh-rsa AAAA... user@host`).","Verify the YAML parses correctly: `kops replace -f ssh.yaml --dry-run` or inspect with `yq '.spec.publicKey'`.","Regenerate the key if lost: `ssh-keygen -t ed25519` and paste the .pub content.","Use `kops create sshpublickey --pubkey ~/.ssh/id_ed25519.pub` as an alternative path."],"exampleFix":"# before\nspec: {}\n# after\nspec:\n  publicKey: \"ssh-ed25519 AAAAC3Nza... user@host\"","handlingStrategy":"validation","validationCode":"func publicKeyPresent(spec kops.SSHCredentialSpec) error {\n    if strings.TrimSpace(spec.PublicKey) == \"\" {\n        return fmt.Errorf(\"spec.publicKey must contain an OpenSSH public key\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check the rendered value in templated manifests (helm/kustomize) before apply","Keep the .pub file in source or secrets manager and inline it at render time","Validate with `yq .spec.publicKey` before `kops replace`","Reject empty/whitespace keys in your CI lint step"],"tags":["kops","sshcredential","validation","manifest"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}