kubernetes/kops · error

error listing SSHCredentials: %v

Error message

error listing SSHCredentials: %v

What it means

During MirrorTo, VFSCAStore calls FindSSHPublicKeys to enumerate stored SSH public-key credentials. If that lookup fails (VFS read error, permission denied, malformed store), the failure is wrapped as "error listing SSHCredentials" and the mirror aborts.

Source

Thrown at upup/pkg/fi/vfs_castore.go:216

		klog.V(2).Infof("Skipping key store mirror from %q to %q (same paths)", c.basedir, basedir)
		return nil
	}
	klog.V(2).Infof("Mirroring key store from %q to %q", c.basedir, basedir)

	keysets, err := c.ListKeysets()
	if err != nil {
		return err
	}

	for name, keyset := range keysets {
		if err := mirrorKeyset(ctx, c.cluster, basedir, name, keyset); err != nil {
			return err
		}
	}

	sshCredentials, err := c.FindSSHPublicKeys()
	if err != nil {
		return fmt.Errorf("error listing SSHCredentials: %v", err)
	}

	for _, sshCredential := range sshCredentials {
		if err := mirrorSSHCredential(ctx, c.cluster, basedir, sshCredential); err != nil {
			return err
		}
	}

	return nil
}

// mirrorKeyset writes Keyset bundles for the certificates & privatekeys.
func mirrorKeyset(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, name string, keyset *Keyset) error {
	if err := writeKeysetBundle(ctx, cluster, basedir.Join("private"), name, keyset); err != nil {
		return fmt.Errorf("writing private bundle: %v", err)
	}

	return nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run the mirror after confirming read access to <state>/private/ssh in the source store.
2. Check IAM policies for list/get on the SSH credential paths.
3. Verify the ssh credential files were not manually moved/deleted; restore the expected layout.
4. Retry on transient errors; if persistent, use kops get sshpublickey to test listing directly.

// Confirm SSH public keys are listable before a mirror
if _, err := store.FindSSHPublicKeys(); err != nil {
	return fmt.Errorf("pre-mirror check failed: %w", err)
}

if err := store.MirrorTo(ctx, dest); err != nil {
	if strings.Contains(err.Error(), "SSHCredentials") {
		return retryWithBackoff(func() error { return store.MirrorTo(ctx, dest) })
	}
	return err
}

When it happens

Trigger: Running kops mirror/CA-store mirroring (MirrorTo) when the source state store cannot be read for ssh/public credentials: missing IAM list permissions, transient storage errors, or a corrupted credential directory layout.

Common situations: Mirroring clusters between accounts/regions with read-only IAM; network blips during long mirror operations; state store migrated manually and the private/ssh layout is inconsistent.

Related errors

• error adding SSH public key: %v
• error deleting SSH public key: %v
• error reading full cluster spec for %q: %v
• listing SSH credentials %v
• reading kops-channels manifest %s: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/678c5360b0874458. Report an issue: GitHub.