kubernetes/kops · error

error generating RSA private key: %v

Error message

error generating RSA private key: %v

What it means

rsa.GenerateKey failed while creating the RSA private key of the configured size. Go returns an error here only on entropy/rand reader failure (rare) or resource constraints; kOps wraps and propagates it.

Source

Thrown at pkg/pki/privatekey.go:68

	return &PrivateKey{Key: k}, nil
}

func GeneratePrivateKey() (*PrivateKey, error) {
	rsaKeySize := DefaultPrivateKeySize

	if os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE") != "" {
		s := os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE")
		if v, err := strconv.Atoi(s); err != nil {
			return nil, fmt.Errorf("error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer", s)
		} else {
			rsaKeySize = int(v)
			klog.V(4).Infof("Generating key of size %d, set by KOPS_RSA_PRIVATE_KEY_SIZE env var", rsaKeySize)
		}
	}

	rsaKey, err := rsa.GenerateKey(crypto_rand.Reader, rsaKeySize)
	if err != nil {
		return nil, fmt.Errorf("error generating RSA private key: %v", err)
	}

	privateKey := &PrivateKey{Key: rsaKey}
	return privateKey, nil
}

type PrivateKey struct {
	Key crypto.Signer
}

func (k *PrivateKey) AsString() (string, error) {
	// Nicer behaviour because this is called from templates
	if k == nil {
		return "", fmt.Errorf("AsString called on nil private key")
	}

	var data bytes.Buffer
	_, err := k.WriteTo(&data)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the operation; entropy failures are typically transient.
2. Check /dev/urandom availability and host entropy (or ensure getrandom works) in the container.
3. Reduce KOPS_RSA_PRIVATE_KEY_SIZE to 2048 or 4096 if an extreme size was requested.
4. Verify node memory/CPU is sufficient for the requested key size.

if s := os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE"); s != "" {
    if v, err := strconv.Atoi(s); err == nil && v > 8192 {
        return fmt.Errorf("key size %d likely too large for this host", v)
    }
}

key, err := pki.GeneratePrivateKey()
if err != nil {
    if strings.Contains(err.Error(), "generating RSA private key") {
        time.Sleep(time.Second)
        key, err = pki.GeneratePrivateKey() // one retry
    }
    if err != nil { return err }
}

When it happens

Trigger: Any call path into GeneratePrivateKey (createKeypair, IssueCert, BuildChallengeServerCertificate, Run) where crypto/rand reads fail — e.g. exhausted entropy, extremely large KOPS_RSA_PRIVATE_KEY_SIZE values causing timeout/OOM in constrained environments.

Common situations: Containers/virtual machines with depleted entropy pools, setting KOPS_RSA_PRIVATE_KEY_SIZE very high (e.g. 16384) on small nodes causing long generation or memory pressure.

Related errors

• error generating private key: %v
• generating ecdsa key: %w
• error converting public key to x509: %w
• error getting random data: %w
• error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf1ff6b361781073. Report an issue: GitHub.