kubernetes/kops · error

AsString called on nil private key

Error message

AsString called on nil private key

What it means

PrivateKey.AsString defensively checks for a nil receiver because it is invoked from Go templates, where a missing value often surfaces as a nil pointer. Instead of panicking on k.WriteTo, it returns this descriptive error so template rendering fails with a clear message.

Source

Thrown at pkg/pki/privatekey.go:82

	}

	rsaKey, err := rsa.GenerateKey(crypto_rand.Reader, rsaKeySize)
	if err != nil {
		return nil, fmt.Errorf("error generating RSA private key: %v", err)
	}

	privateKey := &PrivateKey{Key: rsaKey}
	return privateKey, nil
}

type PrivateKey struct {
	Key crypto.Signer
}

func (k *PrivateKey) AsString() (string, error) {
	// Nicer behaviour because this is called from templates
	if k == nil {
		return "", fmt.Errorf("AsString called on nil private key")
	}

	var data bytes.Buffer
	_, err := k.WriteTo(&data)
	if err != nil {
		return "", fmt.Errorf("error writing SSL private key: %v", err)
	}
	return data.String(), nil
}

func (k *PrivateKey) AsBytes() ([]byte, error) {
	// Nicer behaviour because this is called from templates
	if k == nil {
		return nil, fmt.Errorf("AsBytes called on nil private key")
	}

	var data bytes.Buffer
	_, err := k.WriteTo(&data)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the upstream lookup so a real *PrivateKey is passed (generate/restore the keypair before rendering).
2. Add a caller-side nil check before invoking AsString.
3. Verify the keyset for the cluster contains the expected private key entry.

Example fix

// before
keyStr, _ := privateKey.AsString()
// after
if privateKey == nil {
    return fmt.Errorf("private key not available")
}
keyStr, err := privateKey.AsString()

if privateKey == nil {
    return fmt.Errorf("cannot render: private key not generated")
}

func (k *PrivateKey) IsNil() bool { return k == nil }

s, err := privateKey.AsString()
if err != nil {
    if strings.Contains(err.Error(), "nil private key") {
        // regenerate key then retry template render
    }
    return err
}

When it happens

Trigger: Calling AsString on a *PrivateKey that is nil — typically when a template references a key that was never generated or loaded (e.g. nil result of a failed/absent keypair lookup passed into a template).

Common situations: Rendering nodeup/cluster templates where the private key task was skipped or its keystore lookup returned nil; building kubecfg credentials when a keyset entry is missing.

Related errors

• AsBytes called on nil private key
• error writing SSL private key: %v
• error writing SSL PrivateKey: %v
• unknown private key type: %T
• could not parse private key (unable to decode PEM)

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6e6ee16dd18628d9. Report an issue: GitHub.