{"record":{"id":"c44f7a062f91bc2a","repo":"kubernetes/kops","slug":"method-addsshpublickey-not-supported-in-server-sid","errorCode":null,"errorMessage":"method AddSSHPublicKey not supported in server-side client","messagePattern":"method AddSSHPublicKey not supported in server-side client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/controllerclientset/sshcredentialstore.go","lineNumber":57,"sourceCode":"\t\tklog.Fatalf(\"cluster / cluster.Name is required\")\n\t}\n\n\ts := &sshCredentialStore{\n\t\tclusterBasePath: clusterBasePath,\n\t\tcluster:         cluster,\n\t}\n\n\treturn s\n}\n\n// DeleteSSHCredential deletes the specified SSH credential.\nfunc (s *sshCredentialStore) DeleteSSHCredential() error {\n\treturn fmt.Errorf(\"method DeleteSSHCredential not supported in server-side client\")\n}\n\n// AddSSHPublicKey adds an SSH public key.\nfunc (s *sshCredentialStore) AddSSHPublicKey(ctx context.Context, data []byte) error {\n\treturn fmt.Errorf(\"method AddSSHPublicKey not supported in server-side client\")\n}\n\n// FindSSHPublicKeys retrieves the SSH public keys.\nfunc (s *sshCredentialStore) FindSSHPublicKeys() ([]*kops.SSHCredential, error) {\n\tklog.Warningf(\"method FindSSHPublicKeys is stub-implemented supported in server-side client\")\n\treturn nil, nil\n}\n","sourceCodeStart":39,"sourceCodeEnd":65,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/controllerclientset/sshcredentialstore.go#L39-L65","documentation":"The server-side sshCredentialStore cannot add SSH public keys; AddSSHPublicKey always returns this sentinel error. This is hit by several kops create/update/replace flows (RunCreate, RunCreateCluster, RunCreateSSHPublicKey, RunReplace, RunUpdateCluster, and cluster creation) whenever they attempt to upload an SSH public key to a server-side registry. No key material is written and the invoking kops command fails.","triggerScenarios":"Calling AddSSHPublicKey on a server-side-backed registry, i.e. running `kops create cluster --ssh-public-key ...`, `kops create sshpublickey`, `kops replace`, `kops update cluster` with key upload, against a cluster configured for the server-side controller registry.","commonSituations":"Creating a new cluster while pointing at a server-side registry; re-running `kops update cluster` after adding --ssh-public-key; CI pipelines that provision clusters and upload keys in one step; users who migrated state from S3 state store to the server-side mode and now can't upload keys.","solutions":["Create the sshpublickey secret directly with kubectl: `kubectl -n kube-system create secret generic sshpublickey.admin --from-file=...`","Upload the key via the standard kops state-store registry client (e.g. run kops with the legacy registry configured) before switching to server-side mode","Pre-provision SSH credentials during cluster bootstrap (cloud-init / nodeup configuration) instead of uploading through this client","Implement AddSSHPublicKey in cmd/kops-controller/pkg/controllerclientset/sshcredentialstore.go backed by the secret API"],"exampleFix":"// before\nstore, err := registry.SSHCredentialStore(clusterName)\nif err != nil { return err }\nif err := store.AddSSHPublicKey(ctx, keyBytes); err != nil { return err } // fails on server-side client\n// after\nerr = kubectlCreateSecret(ctx, \"kube-system\", \"sshpublickey.admin\", keyBytes)","handlingStrategy":"try-catch","validationCode":"// Refuse key upload early when the registry is the server-side clientset:\nif isServerSideRegistry(registry) {\n\treturn fmt.Errorf(\"AddSSHPublicKey unsupported: create the sshpublickey secret with kubectl instead\")\n}\n","typeGuard":"func isServerSideStore(v interface{}) bool {\n\t_, ok := v.(*controllerclientset.SSHCredentialStoreProxy)\n\treturn ok\n}","tryCatchPattern":"if err := store.AddSSHPublicKey(ctx, keyBytes); err != nil {\n\tif strings.Contains(err.Error(), \"not supported in server-side client\") {\n\t\treturn kubectl.CreateSecret(ctx, \"kube-system\", \"sshpublickey.\"+keyName, keyBytes)\n\t}\n\treturn err\n}","preventionTips":["Upload SSH keys via kubectl secret creation when using server-side mode","Avoid --ssh-public-key flags on create/update commands pointed at a server-side registry","Provision SSH keys at bootstrap (nodeup/cloud-init) instead of post-hoc upload","Add a preflight check in automation that skips key upload when the server-side clientset is detected"],"tags":["kubernetes","kops-controller","ssh","credentials","unsupported-method"],"backgroundTag":"unsupported-clientset-method","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}