{"record":{"id":"d88699868630517f","repo":"kubernetes/kops","slug":"unknown-private-key-type-t","errorCode":null,"errorMessage":"unknown private key type: %T","messagePattern":"unknown private key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/privatekey.go","lineNumber":168,"sourceCode":"\t}\n\n\tvar data bytes.Buffer\n\n\tswitch pk := k.Key.(type) {\n\tcase *rsa.PrivateKey:\n\t\tif err := pem.Encode(&data, &pem.Block{Type: \"RSA PRIVATE KEY\", Bytes: x509.MarshalPKCS1PrivateKey(pk)}); err != nil {\n\t\t\treturn 0, fmt.Errorf(\"error encoding RSA private key: %w\", err)\n\t\t}\n\tcase *ecdsa.PrivateKey:\n\t\tb, err := x509.MarshalECPrivateKey(pk)\n\t\tif err != nil {\n\t\t\treturn 0, fmt.Errorf(\"error encoding ECDSA private key: %w\", err)\n\t\t}\n\t\tif err := pem.Encode(&data, &pem.Block{Type: \"EC PRIVATE KEY\", Bytes: b}); err != nil {\n\t\t\treturn 0, fmt.Errorf(\"error encoding ECDSA private key: %w\", err)\n\t\t}\n\tdefault:\n\t\treturn 0, fmt.Errorf(\"unknown private key type: %T\", k.Key)\n\t}\n\n\treturn data.WriteTo(w)\n}\n\nfunc (k *PrivateKey) WriteToFile(filename string, perm os.FileMode) error {\n\tf, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)\n\tif err != nil {\n\t\treturn err\n\t}\n\t_, err = k.WriteTo(f)\n\tif err1 := f.Close(); err == nil {\n\t\terr = err1\n\t}\n\treturn err\n}\n\nfunc parsePEMPrivateKey(pemData []byte) (crypto.Signer, error) {","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/privatekey.go#L150-L186","documentation":"PrivateKey.WriteTo only supports *rsa.PrivateKey and *ecdsa.PrivateKey. If Key holds any other crypto.Signer implementation, the type switch falls to default and returns 'unknown private key type: %T' naming the concrete Go type. Callers AsString, AsBytes, MarshalJSON, and WriteToFile all surface this.","triggerScenarios":"Placing a signer of another algorithm into PrivateKey.Key — typically ed25519.PrivateKey (or ed25519.PublicKey by mistake) obtained from x509.ParsePKCS8PrivateKey on a 'PRIVATE KEY' PEM block, then serializing with AsBytes/AsString/MarshalJSON/WriteToFile.","commonSituations":"Adopting modern Ed25519 keys from external tooling (openssl genpkey -algorithm ED25519) and importing them into kops structures; keys parsed by parsePEMPrivateKey's PKCS8 branch whose type assertion to crypto.Signer succeeds but which WriteTo cannot encode.","solutions":["Read the %T in the message to identify the actual key type stored in Key.","Regenerate the key as RSA or ECDSA using pki.GeneratePrivateKey() or ecdsa.GenerateKey().","If the key must be reused, convert it: for ed25519 there is no conversion — create a new RSA/ECDSA key and reissue certificates.","Add a type check before serializing: only proceed when Key is *rsa.PrivateKey or *ecdsa.PrivateKey."],"exampleFix":"// before\nparsed, _ := x509.ParsePKCS8PrivateKey(der) // ed25519\nk := &pki.PrivateKey{Key: parsed.(crypto.Signer)}\nb, err := k.AsBytes() // error: unknown private key type: ed25519.PrivateKey\n// after\nkey, err := pki.GeneratePrivateKey() // RSA, supported by WriteTo\nb, err := key.AsBytes()","handlingStrategy":"type-guard","validationCode":"switch key.Key.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey:\n    // supported\ndefault:\n    return fmt.Errorf(\"unsupported key algorithm %T; use RSA or ECDSA\", key.Key)\n}","typeGuard":"func isSupportedSigner(k *pki.PrivateKey) bool {\n    if k == nil || k.Key == nil { return false }\n    switch k.Key.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey:\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":"out, err := key.AsBytes()\nif err != nil {\n    if strings.Contains(err.Error(), \"unknown private key type\") {\n        // extract %T from message, regenerate as RSA/ECDSA\n    }\n    return err\n}","preventionTips":["Reject Ed25519 and other algorithms at key-import time with a clear error.","Check openssl/other-tool defaults — modern tools may emit ed25519 instead of RSA.","Add a unit test asserting WriteTo/AsBytes works for every key shape your pipeline produces."],"tags":["pki","type-error","private-key"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}