{"record":{"id":"e95ca85640a11135","repo":"kubernetes/kops","slug":"adding-key-to-ssh-agent-w","errorCode":null,"errorMessage":"adding key to SSH agent: %w","messagePattern":"adding key to SSH agent: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/toolbox_dump.go","lineNumber":222,"sourceCode":"\t\t\tUser:   options.SSHUser,\n\t\t\tAuth: []ssh.AuthMethod{\n\t\t\t\tssh.PublicKeys(signer),\n\t\t\t},\n\t\t\tHostKeyCallback: ssh.InsecureIgnoreHostKey(), //nolint:gosec // toolbox dump connects to cluster nodes without managed host keys.\n\t\t}\n\n\t\tklog.Infof(\"will SSH using username %q\", sshConfig.User)\n\t\tklog.Infof(\"ssh auth methods %v\", sshConfig.Auth)\n\n\t\tkeyRing := agent.NewKeyring()\n\t\tdefer func(keyRing agent.Agent) {\n\t\t\t_ = keyRing.RemoveAll()\n\t\t}(keyRing)\n\t\terr = keyRing.Add(agent.AddedKey{\n\t\t\tPrivateKey: parsedKey,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"adding key to SSH agent: %w\", err)\n\t\t}\n\n\t\t// look for a bastion instance and use it if exists\n\t\t// Prefer a bastion load balancer if exists\n\t\tbastionAddress := \"\"\n\t\tif cloudResources != nil {\n\t\t\tfor _, lb := range cloudResources.LoadBalancers {\n\t\t\t\tif strings.Contains(lb.Name, \"bastion\") && lb.DNSName != \"\" {\n\t\t\t\t\tbastionAddress = lb.DNSName\n\t\t\t\t}\n\t\t\t}\n\t\t\tif bastionAddress == \"\" {\n\t\t\t\tfor _, instance := range cloudResources.Instances {\n\t\t\t\t\tif strings.Contains(instance.Name, \"bastion\") {\n\t\t\t\t\t\tbastionAddress = instance.PublicAddresses[0]\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/toolbox_dump.go#L204-L240","documentation":"Toolbox dump adds the parsed key to a local ssh agent keyring so it can authenticate to the bastion. This error wraps a failure from keyRing.Add(agent.AddedKey{...}) — the in-process agent refused the key.","triggerScenarios":"During RunToolboxDump's deferred setup, keyRing.Add fails for the parsed private key — typically because the key type/length is rejected by the agent, or the key material is inconsistent with what the agent supports.","commonSituations":"Key parsed successfully but is an unsupported algorithm for the agent's signer registration; concurrent agent state issues; extremely large or malformed key structures.","solutions":["Regenerate with a standard key type (ed25519 or rsa 4096) and retry.","Verify the key works directly: ssh-add <key> — if ssh-add rejects it, the key is the problem.","Upgrade kops (vendored golang.org/x/crypto agent code).","Bypass agent use by ensuring normal SSH config/auth to the bastion works, then retry the dump."],"exampleFix":"// before\nkops toolbox dump --private-key exotic_curve_key  # agent.Add fails\n// after\nssh-keygen -t ed25519 -N '' -f ok_key\nkops toolbox dump --private-key ok_key","handlingStrategy":"try-catch","validationCode":"ssh-add \"$KEY_PATH\" 2>/dev/null || echo \"warning: agent may reject this key type\"","typeGuard":null,"tryCatchPattern":"err = keyRing.Add(agent.AddedKey{PrivateKey: parsedKey})\nif err != nil {\n    return fmt.Errorf(\"adding key to SSH agent (key type may be unsupported): %w\", err)\n}","preventionTips":["Use standard ed25519/rsa keys the agent can register","Pre-verify with ssh-add locally before kops toolbox dump","If a system agent is running, ensure it is healthy (ssh-add -l succeeds)","Upgrade kops to get updated agent code"],"tags":["kops","ssh-agent","bastion"],"backgroundTag":"ssh-agent-add-key-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}