kubernetes/kops · error

error adding SSH public key: %v

Error message

error adding SSH public key: %v

What it means

After the cluster config is persisted, RunCreateCluster adds each provided SSH public key via sshCredentialStore.AddSSHPublicKey. If that call fails, the error is wrapped and returned, leaving the cluster config already written. The cause is usually a state-store write failure for the sshcredentials object.

Source

Thrown at cmd/kops/create_cluster.go:871

					merr = multierr.Append(merr, err)
				}
			}
			if merr != nil && len(c.SSHPublicKeys) == 0 {
				return fmt.Errorf("error reading SSH public key files %q: %v", sshPublicKeyPaths, merr)
			}
		}
	}

	if len(c.SSHPublicKeys) != 0 {
		sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
		if err != nil {
			return err
		}

		for _, data := range c.SSHPublicKeys {
			err = sshCredentialStore.AddSSHPublicKey(ctx, data)
			if err != nil {
				return fmt.Errorf("error adding SSH public key: %v", err)
			}
		}
	}

	// Can we actually get to this if??
	if targetName != "" {
		if isDryrun {
			fmt.Fprintf(out, "Previewing changes that will be made:\n\n")
		}

		// TODO: Maybe just embed UpdateClusterOptions in CreateClusterOptions?
		updateClusterOptions := &UpdateClusterOptions{}
		updateClusterOptions.InitDefaults()

		updateClusterOptions.Yes = c.Yes
		updateClusterOptions.Target = c.Target
		updateClusterOptions.OutDir = c.OutDir
		updateClusterOptions.ClusterName = cluster.Name

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v for the storage-layer cause.
2. Retry `kops create sshpublickey <cluster> -i <key>` to add the key to the already-created cluster.
3. Verify state-store permissions and connectivity.
4. If the key file is corrupt, regenerate it and re-run.

Example fix

// before
kops create cluster --ssh-public-key ~/.ssh/broken_key.pub ...
// after
ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub
kops create cluster --ssh-public-key ~/.ssh/id_rsa.pub ...
# or on the already-created cluster:
kops create sshpublickey c.k8s.local -i ~/.ssh/id_rsa.pub

if err := runCreateCluster(...); err != nil {
	if strings.Contains(err.Error(), "error adding SSH public key") {
		// cluster already created; retry just the key upload:
		// kops create sshpublickey <cluster> -i <keyfile>
	}
	return err
}

When it happens

Trigger: `kops create cluster --ssh-public-key <file>` where AddSSHPublicKey fails writing to the state store (permissions, connectivity, transient backend error) after the cluster config was created.

Common situations: S3/GCS credentials lost between the config write and the key write; transient network drop; state store read-only; malformed key data rejected by the store.

Related errors

• error deleting SSH public key: %v
• listing SSH credentials %v
• error creating cluster: %v
• error querying cluster %q: %v
• must specify %q label with cluster name to create SSHCredent

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3f13940451dbca36. Report an issue: GitHub.