kubernetes/kops · error

error adding key: %v: %s

Error message

error adding key: %v: %s

What it means

After writing the apt key to the temp file, RenderLocal runs `apt-key add <file>` and captures combined output. If the command fails with an exit code other than the tolerated 100, the error and command output are wrapped with this message. It means the repository key could not be added, so the apt source will not authenticate.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/aptsource.go:83

	}
	defer func() {
		if err := os.RemoveAll(tmpDir); err != nil {
			klog.Warningf("error deleting temp dir %q: %v", tmpDir, err)
		}
	}()
	filename := path.Join(tmpDir, f.Name+".gpg")

	if _, err := fi.DownloadURL(ctx, f.Keyring, filename, nil); err != nil {
		return err
	}

	args := []string{"apt-key", "add", filename}

	klog.Infof("running command %s", args)
	cmd := exec.Command(args[0], args[1:]...)
	output, err := cmd.CombinedOutput()
	if exitCode := cmd.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(); err != nil && exitCode != 100 {
		return fmt.Errorf("error adding key: %v: %s", err, string(output))
	}

	debs := strings.Join(f.Sources, "\n")

	if err := os.WriteFile("/etc/apt/sources.list.d/"+f.Name+".list", []byte(debs), 0); err != nil {
		return err
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the key file content is a valid PGP key (not an HTML error page) from the keyserver URL
2. On distros where apt-key is removed, use signed-by keyrings (update the kOps/cluster channel so the model uses /etc/apt/trusted.gpg.d or signed-by)
3. Check the wrapped command output in the error for the gpg failure detail
4. Re-run nodeup once network/DNS to the keyserver is working

// validate key material is a PGP public key before apt-key add
key, err := os.ReadFile(keyFile)
if err != nil || !bytes.Contains(key, []byte("BEGIN PGP PUBLIC KEY")) {
  return fmt.Errorf("key file %s is not a valid PGP key", keyFile)
}
if _, err := exec.LookPath("apt-key"); err != nil {
  return errors.New("apt-key unavailable on this distro; use signed-by keyrings")

if err := nodeup.Run(ctx); err != nil {
  if strings.Contains(err.Error(), "error adding key") {
    // parse the wrapped apt-key output for the gpg failure
    klog.Errorf("apt key install failed: %v", err)
  }
}

When it happens

Trigger: exec of `apt-key add` returns non-zero (excluding exit 100, which is deliberately tolerated) — bad/unsupported key file, apt-key missing, or gpg errors.

Common situations: Deprecated/removed apt-key on Debian 12+/Ubuntu 22.04+; corrupted or wrong-format key downloaded from the keyserver; network failure producing an empty key file; expired key.

Related errors

• error creating temp dir: %v
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w
• unsupported cloud provider for authenticator %q
• parsing path for kops-channels manifest %s: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/393a4315be7759b0. Report an issue: GitHub.