{"record":{"id":"c4edbf962a53c3c3","repo":"kubernetes/kops","slug":"parsing-key-v","errorCode":null,"errorMessage":"parsing key: %v","messagePattern":"parsing key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/server.go","lineNumber":300,"sourceCode":"\t\tresp.Certs[name] = cert\n\t}\n\n\tw.Header().Set(\"Content-Type\", \"application/json\")\n\t_ = json.NewEncoder(w).Encode(resp)\n\tklog.Infof(\"bootstrap %s (req.includeNodeConfig: %t, req.certs.#: %d, req.keypairs.#: %d) success\", r.RemoteAddr, req.IncludeNodeConfig, len(req.Certs), len(req.KeypairIDs))\n}\n\nfunc (s *Server) issueCert(ctx context.Context, name string, pubKey string, id *bootstrap.VerifyResult, validHours uint32, keypairIDs map[string]string) (string, error) {\n\tblock, _ := pem.Decode([]byte(pubKey))\n\tif block == nil {\n\t\treturn \"\", fmt.Errorf(\"decoding pem public key\")\n\t}\n\tif block.Type != \"RSA PUBLIC KEY\" {\n\t\treturn \"\", fmt.Errorf(\"unexpected key type %q\", block.Type)\n\t}\n\tkey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing key: %v\", err)\n\t}\n\n\tissueReq := &pki.IssueCertRequest{\n\t\tSigner:    fi.CertificateIDCA,\n\t\tType:      \"client\",\n\t\tPublicKey: key,\n\t\tValidity:  time.Hour * time.Duration(validHours),\n\t}\n\n\tif !s.certNames.Has(name) {\n\t\treturn \"\", fmt.Errorf(\"key name not enabled\")\n\t}\n\tswitch name {\n\tcase \"etcd-client-cilium\":\n\t\tissueReq.Signer = \"etcd-clients-ca-cilium\"\n\t\tissueReq.Subject = pkix.Name{\n\t\t\tCommonName: \"cilium\",\n\t\t}","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/server.go#L282-L318","documentation":"issueCert in the kops-controller bootstrap server parses the public key sent by a node from its PEM block via x509.ParsePKIXPublicKey. When the DER bytes do not decode as a valid PKIX public key, the parse error is wrapped as \"parsing key: %v\" and the certificate request fails.","triggerScenarios":"A node POSTs to the bootstrap /issueCert endpoint with a key whose PEM payload is corrupt, truncated, or not a PKIX-encoded public key (e.g. private key bytes, garbage, or an unsupported algorithm).","commonSituations":"Corrupted node key files on disk (partial writes, disk full), nodeup generating or transmitting the wrong key type, tampered/replayed bootstrap requests, or mismatched node bootstrap code from a version skew.","solutions":["Regenerate the node's keypair (delete and re-run nodeup/bootstrap on the node) so a fresh, valid PKIX public key is sent","Verify the PEM block on the node is a PUBLIC KEY block, not a private key or legacy RSA PUBLIC KEY format","Check node logs and disk health for truncated file writes; re-download node bootstrap assets","Upgrade the node/kops version so client and server agree on key encoding"],"exampleFix":"// before (client sending wrong block)\nblock, _ := pem.Decode(privateKeyPEM)\n// after (send the public key, PKIX-encoded)\npubDER, err := x509.MarshalPKIXPublicKey(&privKey.PublicKey)\npemBlock := &pem.Block{Type: \"PUBLIC KEY\", Bytes: pubDER}\npublicPEM := pem.EncodeToMemory(pemBlock)","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(nodeKeyPEM)\nif block == nil || block.Type != \"PUBLIC KEY\" {\n    return fmt.Errorf(\"node sent invalid PEM block %v\", block)\n}\nif _, err := x509.ParsePKIXPublicKey(block.Bytes); err != nil {\n    return fmt.Errorf(\"node public key invalid: %v\", err)\n}","typeGuard":"func isPublicKeyPEM(pemBytes []byte) bool {\n    block, _ := pem.Decode(pemBytes)\n    if block == nil || block.Type != \"PUBLIC KEY\" {\n        return false\n    }\n    _, err := x509.ParsePKIXPublicKey(block.Bytes)\n    return err == nil\n}","tryCatchPattern":"key, err := x509.ParsePKIXPublicKey(block.Bytes)\nif err != nil {\n    log.Printf(\"rejecting bootstrap request: bad public key: %v\", err)\n    return \"\", fmt.Errorf(\"parsing key: %v\", err)\n}","preventionTips":["Always regenerate node keypairs on re-bootstrap; never reuse partial key files","Verify disk health and atomic writes for node key material","Keep node bootstrap code and controller versions aligned","Log the key PEM fingerprint (not contents) on failure to aid diagnosis"],"tags":["tls","certificates","x509","bootstrap"],"backgroundTag":"invalid-public-key","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}