{"record":{"id":"c0116b3189abe838","repo":"kubernetes/kops","slug":"error-adding-ssh-public-key-v-c0116b","errorCode":null,"errorMessage":"error adding SSH public key: %v","messagePattern":"error adding SSH public key: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_sshpublickey.go","lineNumber":99,"sourceCode":"\n\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdata, err := os.ReadFile(options.PublicKeyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error reading SSH public key %v: %v\", options.PublicKeyPath, err)\n\t}\n\n\terr = sshCredentialStore.AddSSHPublicKey(ctx, data)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error adding SSH public key: %v\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":81,"sourceCodeEnd":104,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_sshpublickey.go#L81-L104","documentation":"Returned when `sshCredentialStore.AddSSHPublicKey` fails after the key file was successfully read. This wraps credential-store errors such as invalid key content or failures persisting the key to the state store.","triggerScenarios":"Calling `kops create secret sshpublickey` where AddSSHPublicKey returns an error — typically because the file content is not a valid OpenSSH public key, or the underlying secret store write to the state store fails.","commonSituations":"Passing a private key or a corrupted/truncated public key; key with garbage characters from a bad copy-paste; state store write failures (credentials, unreachable bucket); cluster state not yet created.","solutions":["Validate the file is a proper public key (`ssh-keygen -l -f <path>`); regenerate or re-export it if invalid.","Confirm you are passing the .pub file, not the private key.","If the store write is the cause, check state store credentials/connectivity and that the cluster exists (`kops get <cluster>`)."],"exampleFix":"// before: private key passed, AddSSHPublicKey rejects content\nkops create secret sshpublickey -i id_ed25519\n// after\nkops create secret sshpublickey -i id_ed25519.pub","handlingStrategy":"validation","validationCode":"const { execSync } = require('child_process');\nexecSync(`ssh-keygen -l -f ${pubKeyPath}`, { stdio: 'inherit' }); // fails if not a valid public key","typeGuard":"function looksLikeSSHPublicKey(text) {\n  return /^(ssh-(rsa|ed25519|dss) |ecdsa-sha2-\\S+ |sk-\\S+ )/.test(text.trim());\n}","tryCatchPattern":"try {\n  runKops(['create','secret','sshpublickey', cluster, '-i', pubKeyPath]);\n} catch (e) {\n  if (/error adding SSH public key/.test(e.message)) {\n    console.error('AddSSHPublicKey failed; validate key content and state store access.');\n  }\n  throw e;\n}","preventionTips":["Validate keys with ssh-keygen -l -f before adding","Regenerate keys that fail fingerprinting","Check state store write access for the credential store"],"tags":["cli","ssh","secret","validation","kops"],"backgroundTag":"ssh-public-key-invalid","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}