kubernetes/kops · error

error generating private key: %v

Error message

error generating private key: %v

What it means

This error wraps a failure from pki.GeneratePrivateKey() while `kops create keypair` generates a fresh private key for a CA keyset (used when no --cert path is supplied). The crypto backend failed to produce a usable private key, so keypair creation aborts. It indicates an internal crypto/RNG failure rather than a user-input problem.

Source

Thrown at cmd/kops/create_keypair.go:207

	if options.PrivateKeyPath != "" {
		options.PrivateKeyPath = utils.ExpandPath(options.PrivateKeyPath)
		privateKeyBytes, err := os.ReadFile(options.PrivateKeyPath)
		if err != nil {
			return fmt.Errorf("error reading user provided private key %q: %v", options.PrivateKeyPath, err)
		}

		privateKey, err = pki.ParsePEMPrivateKey(privateKeyBytes)
		if err != nil {
			return fmt.Errorf("error loading private key %q: %v", privateKeyBytes, err)
		}
	}

	var cert *pki.Certificate
	if options.CertPath == "" {
		if privateKey == nil {
			privateKey, err = pki.GeneratePrivateKey()
			if err != nil {
				return fmt.Errorf("error generating private key: %v", err)
			}
		}

		serial := pki.BuildPKISerial(time.Now().UnixNano())
		req := pki.IssueCertRequest{
			Type:       "ca",
			Subject:    pkix.Name{CommonName: name, SerialNumber: serial.String()},
			Serial:     serial,
			PrivateKey: privateKey,
		}
		cert, _, _, err = pki.IssueCert(ctx, &req, nil)
		if err != nil {
			return fmt.Errorf("error issuing certificate: %v", err)
		}
	} else {
		options.CertPath = utils.ExpandPath(options.CertPath)
		certBytes, err := os.ReadFile(options.CertPath)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the command — entropy failures are often transient.
2. Verify the host entropy/PRNG is healthy (/dev/urandom readable, getrandom not blocked).
3. Re-run inside a known-good environment/container image.
4. If persistent, file a kOps issue including the wrapped underlying error text.

// Go: verify the host entropy source before invoking kOps
f, err := os.Open("/dev/urandom")
if err != nil {
    return fmt.Errorf("entropy source unavailable: %w", err)
}
f.Close()

if err := retry(3, backoff, runCreateKeypair); err != nil {
    if strings.Contains(err.Error(), "error generating private key") {
        // entropy/env issue: escalate after retries
    }
}

When it happens

Trigger: Running `kops create keypair <cluster> <keyset>` without --cert (or the rotation path) so pki.GeneratePrivateKey() is invoked and returns a non-nil error, e.g. a crypto/rand entropy source failure.

Common situations: Running kOps in a constrained container/VM with a broken or exhausted entropy source; hardened seccomp profiles blocking getrandom(2); a bug or version mismatch in the crypto library.

Related errors

• error converting public key to x509: %w
• key %q not found
• key %q did not have primary id set
• error generating RSA private key: %v
• missing keypairID for signer %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e4450374dd42bd94. Report an issue: GitHub.