kubernetes/kops · warning

encoding public key %s: %v

Error message

encoding public key %s: %v

What it means

Immediately after marshalling, ToPublicKeys PEM-encodes the PKIX bytes as an 'RSA PUBLIC KEY' block into a strings.Builder. pem.Encode returning an error is essentially impossible with a Builder (writes never fail), so this error is defensive — but if hit it means the public key could not be serialized to PEM.

Source

Thrown at upup/pkg/fi/ca.go:178

	for k, item := range k.Items {
		if item.DistrustTimestamp == nil {
			keys = append(keys, k)
		}
	}
	sort.Slice(keys, func(i, j int) bool {
		return KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)
	})

	buf := new(strings.Builder)
	for _, key := range keys {
		item := k.Items[key]
		if item.Certificate != nil {
			publicKeyData, err := x509.MarshalPKIXPublicKey(item.Certificate.PublicKey)
			if err != nil {
				return "", fmt.Errorf("marshalling public key %s: %v", item.Id, err)
			}
			if err = pem.Encode(buf, &pem.Block{Type: "RSA PUBLIC KEY", Bytes: publicKeyData}); err != nil {
				return "", fmt.Errorf("encoding public key %s: %v", item.Id, err)
			}
		}
	}
	return buf.String(), nil
}

// NewKeyset creates a Keyset.
func NewKeyset(cert *pki.Certificate, privateKey *pki.PrivateKey) (*Keyset, error) {
	keyset := &Keyset{
		Items: map[string]*KeysetItem{},
	}
	_, err := keyset.AddItem(cert, privateKey, true)
	if err != nil {
		return nil, err
	}

	return keyset, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Treat as internal invariant failure; report with the item id and stack.
2. If running a patched kOps, check the custom output writer for errors.
3. Re-run the command; the operation is deterministic so escalate to maintainers if reproducible.

// PEM encode should never fail on a strings.Builder; pre-verify the cert marshals
$ openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum  # DER conversion sanity

try {
  const pemKeys = keyset.toPublicKeys()
} catch (e) {
  if (/encoding public key/.test(e.message)) {
    console.error("PEM encoding failed (likely modified build):", e.message)
    // report bug / check custom writers in patched builds
  }
  throw e
}

When it happens

Trigger: Keyset.ToPublicKeys: pem.Encode fails while writing the PEM block for item.Certificate's public key.

Common situations: In practice unreachable with a strings.Builder sink; seen only if the output writer is changed to a failing io.Writer in a fork/modified build.

Related errors

• failed to parse public key: %w
• failed to get keyset from %q
• failed to read %q certificates: %w
• error writing SSL private key: %v
• could not parse private key

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/27b31cadc44b3bfe. Report an issue: GitHub.