kubernetes/kops · error

creating signer for private key %q: %v

Error message

creating signer for private key %q: %v

What it means

Once the raw key is parsed, toolbox dump converts it into an ssh.Signer via ssh.NewSignerFromKey. This error means the parsed key's type is not supported for signing (unsupported elliptic curve/algo, malformed key struct) — the key parsed but cannot produce a signer.

Source

Thrown at cmd/kops/toolbox_dump.go:174

	if options.Dir != "" {
		privateKeyPath := options.PrivateKey
		if strings.HasPrefix(privateKeyPath, "~/") {
			privateKeyPath = filepath.Join(os.Getenv("HOME"), privateKeyPath[2:])
		}
		key, err := os.ReadFile(privateKeyPath)
		if err != nil {
			return fmt.Errorf("reading private key %q: %v", privateKeyPath, err)
		}

		parsedKey, err := ssh.ParseRawPrivateKey(key)
		if err != nil {
			return fmt.Errorf("parsing private key %q: %v", privateKeyPath, err)
		}

		signer, err := ssh.NewSignerFromKey(parsedKey)
		if err != nil {
			return fmt.Errorf("creating signer for private key %q: %v", privateKeyPath, err)
		}

		contextName := cluster.ObjectMeta.Name
		clientGetter := genericclioptions.NewConfigFlags(true)
		clientGetter.Context = &contextName

		var nodes corev1.NodeList

		// TODO: We should use the factory to get the kubeconfig
		kubeConfig, err := clientGetter.ToRESTConfig()
		if err != nil {
			klog.Warningf("cannot load kubeconfig settings for %q: %v", contextName, err)
		} else {
			k8sClient, err := kubernetes.NewForConfig(kubeConfig)
			if err != nil {
				klog.Warningf("cannot build kube client for %q: %v", contextName, err)
			} else {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the key with a standard type: ssh-keygen -t ed25519 (or rsa -b 4096).
2. Check the key algorithm: ssh-keygen -y -f <key> — failures indicate key problems.
3. Upgrade kops to pick up newer golang.org/x/crypto with broader key support.
4. If DSA, migrate to Ed25519/RSA as DSA is unsupported.

Example fix

// before
kops toolbox dump --private-key old_dsa_key   # unsupported key type
// after
ssh-keygen -t ed25519 -N '' -f new_key
kops toolbox dump --private-key new_key

ALGO=$(ssh-keygen -y -e -f "$KEY_PATH" 2>/dev/null | head -c 20) || { echo "cannot read key"; exit 1; }
case "$KEY_PATH" in *dsa*) echo "DSA keys unsupported; regenerate with ed25519"; exit 1;; esac

signer, err := ssh.NewSignerFromKey(parsedKey)
if err != nil {
    return fmt.Errorf("unsupported key type in %q (use rsa/ecdsa/ed25519): %w", privateKeyPath, err)
}

When it happens

Trigger: ssh.NewSignerFromKey(parsedKey) fails because parsedKey is not one of the supported types (*rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey) — e.g. an exotic curve or malformed key material passed the PEM stage.

Common situations: Keys on unusual curves (e.g. secp256k1) or legacy DSA keys unsupported by the vendored x/crypto version; a corrupted-but-parseable key; generated with a tool producing non-standard key structures.

Related errors

• must specify %q label with cluster name to create SSHCredent
• spec.PublicKey is required
• error reading SSH public key %v: %v
• error adding SSH public key: %v
• use 'kops get sshpublickey' instead

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a28ded389dd11c79. Report an issue: GitHub.