kubernetes/kops · error

error adding SSH public key: %v

Error message

error adding SSH public key: %v

What it means

Returned when `sshCredentialStore.AddSSHPublicKey` fails after the key file was successfully read. This wraps credential-store errors such as invalid key content or failures persisting the key to the state store.

Source

Thrown at cmd/kops/create_sshpublickey.go:99

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
	if err != nil {
		return err
	}

	data, err := os.ReadFile(options.PublicKeyPath)
	if err != nil {
		return fmt.Errorf("error reading SSH public key %v: %v", options.PublicKeyPath, err)
	}

	err = sshCredentialStore.AddSSHPublicKey(ctx, data)
	if err != nil {
		return fmt.Errorf("error adding SSH public key: %v", err)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate the file is a proper public key (`ssh-keygen -l -f <path>`); regenerate or re-export it if invalid.
2. Confirm you are passing the .pub file, not the private key.
3. If the store write is the cause, check state store credentials/connectivity and that the cluster exists (`kops get <cluster>`).

Example fix

// before: private key passed, AddSSHPublicKey rejects content
kops create secret sshpublickey -i id_ed25519
// after
kops create secret sshpublickey -i id_ed25519.pub

const { execSync } = require('child_process');
execSync(`ssh-keygen -l -f ${pubKeyPath}`, { stdio: 'inherit' }); // fails if not a valid public key

function looksLikeSSHPublicKey(text) {
  return /^(ssh-(rsa|ed25519|dss) |ecdsa-sha2-\S+ |sk-\S+ )/.test(text.trim());
}

try {
  runKops(['create','secret','sshpublickey', cluster, '-i', pubKeyPath]);
} catch (e) {
  if (/error adding SSH public key/.test(e.message)) {
    console.error('AddSSHPublicKey failed; validate key content and state store access.');
  }
  throw e;
}

When it happens

Trigger: Calling `kops create secret sshpublickey` where AddSSHPublicKey returns an error — typically because the file content is not a valid OpenSSH public key, or the underlying secret store write to the state store fails.

Common situations: Passing a private key or a corrupted/truncated public key; key with garbage characters from a bad copy-paste; state store write failures (credentials, unreachable bucket); cluster state not yet created.

Related errors

• spec.PublicKey is required
• must specify %q label with cluster name to create SSHCredent
• adding keypair to %q is not supported
• reading encryption config %v: %v
• unable to parse YAML %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c0116b3189abe838. Report an issue: GitHub.