kubernetes/kops · error

adding key to SSH agent: %w

Error message

adding key to SSH agent: %w

What it means

Toolbox dump adds the parsed key to a local ssh agent keyring so it can authenticate to the bastion. This error wraps a failure from keyRing.Add(agent.AddedKey{...}) — the in-process agent refused the key.

Source

Thrown at cmd/kops/toolbox_dump.go:222

			User:   options.SSHUser,
			Auth: []ssh.AuthMethod{
				ssh.PublicKeys(signer),
			},
			HostKeyCallback: ssh.InsecureIgnoreHostKey(), //nolint:gosec // toolbox dump connects to cluster nodes without managed host keys.
		}

		klog.Infof("will SSH using username %q", sshConfig.User)
		klog.Infof("ssh auth methods %v", sshConfig.Auth)

		keyRing := agent.NewKeyring()
		defer func(keyRing agent.Agent) {
			_ = keyRing.RemoveAll()
		}(keyRing)
		err = keyRing.Add(agent.AddedKey{
			PrivateKey: parsedKey,
		})
		if err != nil {
			return fmt.Errorf("adding key to SSH agent: %w", err)
		}

		// look for a bastion instance and use it if exists
		// Prefer a bastion load balancer if exists
		bastionAddress := ""
		if cloudResources != nil {
			for _, lb := range cloudResources.LoadBalancers {
				if strings.Contains(lb.Name, "bastion") && lb.DNSName != "" {
					bastionAddress = lb.DNSName
				}
			}
			if bastionAddress == "" {
				for _, instance := range cloudResources.Instances {
					if strings.Contains(instance.Name, "bastion") {
						bastionAddress = instance.PublicAddresses[0]
					}
				}
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate with a standard key type (ed25519 or rsa 4096) and retry.
2. Verify the key works directly: ssh-add <key> — if ssh-add rejects it, the key is the problem.
3. Upgrade kops (vendored golang.org/x/crypto agent code).
4. Bypass agent use by ensuring normal SSH config/auth to the bastion works, then retry the dump.

Example fix

// before
kops toolbox dump --private-key exotic_curve_key  # agent.Add fails
// after
ssh-keygen -t ed25519 -N '' -f ok_key
kops toolbox dump --private-key ok_key

ssh-add "$KEY_PATH" 2>/dev/null || echo "warning: agent may reject this key type"

err = keyRing.Add(agent.AddedKey{PrivateKey: parsedKey})
if err != nil {
    return fmt.Errorf("adding key to SSH agent (key type may be unsupported): %w", err)
}

When it happens

Trigger: During RunToolboxDump's deferred setup, keyRing.Add fails for the parsed private key — typically because the key type/length is rejected by the agent, or the key material is inconsistent with what the agent supports.

Common situations: Key parsed successfully but is an unsupported algorithm for the agent's signer registration; concurrent agent state issues; extremely large or malformed key structures.

Related errors

• unhandled bastion LoadBalancer type %q
• error assigning default machine type for bastions: %v
• error creating kops config template: %w
• error creating gcp machine template: %w
• error building machine deployments: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e95ca85640a11135. Report an issue: GitHub.