kubernetes/kops · warning

error encoding RSA private key: %w

Error message

error encoding RSA private key: %w

What it means

PrivateKey.WriteTo encodes RSA keys as PKCS#1 DER inside a 'RSA PRIVATE KEY' PEM block; pem.Encode virtually never fails for a well-formed block, so this error indicates an unexpected internal encoding problem while writing the RSA key PEM.

Source

Thrown at pkg/pki/privatekey.go:157

		return nil, fmt.Errorf("error writing SSL private key: %v", err)
	}
	return json.Marshal(data.String())
}

var _ io.WriterTo = &PrivateKey{}

func (k *PrivateKey) WriteTo(w io.Writer) (int64, error) {
	if k.Key == nil {
		// For the dry-run case
		return 0, nil
	}

	var data bytes.Buffer

	switch pk := k.Key.(type) {
	case *rsa.PrivateKey:
		if err := pem.Encode(&data, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(pk)}); err != nil {
			return 0, fmt.Errorf("error encoding RSA private key: %w", err)
		}
	case *ecdsa.PrivateKey:
		b, err := x509.MarshalECPrivateKey(pk)
		if err != nil {
			return 0, fmt.Errorf("error encoding ECDSA private key: %w", err)
		}
		if err := pem.Encode(&data, &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}); err != nil {
			return 0, fmt.Errorf("error encoding ECDSA private key: %w", err)
		}
	default:
		return 0, fmt.Errorf("unknown private key type: %T", k.Key)
	}

	return data.WriteTo(w)
}

func (k *PrivateKey) WriteToFile(filename string, perm os.FileMode) error {
	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Treat as unexpected: retry the operation once, then reproduce with a minimal key to file a bug if persistent.
2. Verify no custom middleware wraps io.Writer passed to WriteTo in a way that corrupts the buffer.
3. Confirm the key is a standard *rsa.PrivateKey (not a wrapper type) via %T inspection.

if _, ok := key.Key.(*rsa.PrivateKey); !ok {
    return fmt.Errorf("not an RSA private key")
}

func isRSAKey(k *pki.PrivateKey) bool { return k != nil && k.Key != nil }, // use: _, ok := k.Key.(*rsa.PrivateKey)

s, err := key.AsString()
if err != nil {
    if strings.Contains(err.Error(), "error encoding RSA private key") {
        // unexpected; retry once, then escalate
    }
    return err
}

When it happens

Trigger: Calling WriteTo (directly or via AsString/AsBytes/MarshalJSON/WriteToFile) on a PrivateKey holding an *rsa.PrivateKey when pem.Encode returns an error on the internal bytes.Buffer.

Common situations: Extremely rare in practice because pem.Encode to a bytes.Buffer with valid DER cannot fail; would only surface from memory/IO anomalies or modified library code.

Related errors

• error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer
• error generating RSA private key: %v
• unknown CA %q
• reading %q certificate: %v
• unexpected key type %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e93bdcd58868db09. Report an issue: GitHub.