{"record":{"id":"d1baeaea1a718761","repo":"kubernetes/kops","slug":"error-deleting-sshcredential-v","errorCode":null,"errorMessage":"error deleting SSHCredential: %v","messagePattern":"error deleting SSHCredential: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":292,"sourceCode":"\tsshCredential.Spec.PublicKey = publicKey\n\tif create {\n\t\tif _, err := client.Create(ctx, sshCredential, metav1.CreateOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"error creating SSHCredential: %v\", err)\n\t\t}\n\t} else {\n\t\tif _, err := client.Update(ctx, sshCredential, metav1.UpdateOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"error updating SSHCredential: %v\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// deleteSSHCredential deletes the SSHCredential from the registry.\nfunc (c *ClientsetCAStore) deleteSSHCredential(ctx context.Context) error {\n\tclient := c.clientset.SSHCredentials(c.namespace)\n\terr := client.Delete(ctx, \"admin\", metav1.DeleteOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error deleting SSHCredential: %v\", err)\n\t}\n\treturn nil\n}\n\n// AddSSHPublicKey implements CAStore::AddSSHPublicKey\nfunc (c *ClientsetCAStore) AddSSHPublicKey(ctx context.Context, pubkey []byte) error {\n\t_, _, _, _, err := ssh.ParseAuthorizedKey(pubkey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error parsing SSH public key: %v\", err)\n\t}\n\n\treturn c.addSSHCredential(ctx, strings.TrimSpace(string(pubkey)))\n}\n\n// FindSSHPublicKeys implements CAStore::FindSSHPublicKeys\nfunc (c *ClientsetCAStore) FindSSHPublicKeys() ([]*kops.SSHCredential, error) {\n\tctx := context.TODO()\n","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L274-L310","documentation":"deleteSSHCredential issues a DELETE for the 'admin' SSHCredential via the clientset. Any error from Delete (other than success) is wrapped as 'error deleting SSHCredential: %v'. It means the API server refused the delete of the SSH credential object.","triggerScenarios":"DeleteSSHCredential called while client.Delete(ctx, \"admin\", ...) fails: object already gone returning non-NotFound error, RBAC denial on delete, finalizers blocking deletion, or API server errors.","commonSituations":"`kops delete sshpublickey` with insufficient permissions; a Kubernetes finalizer or owner reference preventing deletion; cluster state store out of sync.","solutions":["Check if the cause is NotFound — the credential may already be deleted; treat as success","Verify RBAC grants delete on sshcredentials.kops.k8s.io","Check for finalizers on the SSHCredential object via kubectl and clear them","Verify API server health before retrying"],"exampleFix":"// before\nif err := store.DeleteSSHCredential(ctx); err != nil { return err }\n// after\nif err := store.DeleteSSHCredential(ctx); err != nil {\n\tif strings.Contains(err.Error(), \"not found\") {\n\t\treturn nil // already deleted\n\t}\n\treturn err\n}","handlingStrategy":"type-guard","validationCode":"// check the object exists before deleting\n_, err := clientset.SSHCredentials(ns).Get(ctx, \"admin\", metav1.GetOptions{})\nif apierrors.IsNotFound(err) { return nil } // nothing to delete","typeGuard":"func isNotFound(err error) bool { return apierrors.IsNotFound(err) }","tryCatchPattern":"if err := store.DeleteSSHCredential(ctx); err != nil {\n\tif isNotFound(err) { return nil } // idempotent success\n\treturn err\n}","preventionTips":["Make delete idempotent: treat NotFound as success","Inspect finalizers with kubectl if deletion hangs","Grant delete on sshcredentials.kops.k8s.io","Verify cluster connectivity before delete operations"],"tags":["kubernetes","ssh","delete","rbac"],"backgroundTag":"kubernetes-api-write-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}