kubernetes/kops · error

error listing SSHCredentials: %v

Error message

error listing SSHCredentials: %v

What it means

MirrorTo mirrors keysets and SSH credentials from the API-store-backed CAStore to a filesystem-basedir. When FindSSHPublicKeys fails, the error is re-wrapped as 'error listing SSHCredentials: %v', so the underlying cause is usually the FindSSHPublicKeys read error (see 1826).

Source

Thrown at upup/pkg/fi/clientset_castore.go:345

	return c.deleteSSHCredential(ctx)
}

func (c *ClientsetCAStore) MirrorTo(ctx context.Context, basedir vfs.Path) error {
	keysets, err := c.ListKeysets()
	if err != nil {
		return err
	}

	for name, keyset := range keysets {
		if err := mirrorKeyset(ctx, c.cluster, basedir, name, keyset); err != nil {
			return err
		}
	}

	sshCredentials, err := c.FindSSHPublicKeys()
	if err != nil {
		return fmt.Errorf("error listing SSHCredentials: %v", err)
	}

	for _, sshCredential := range sshCredentials {
		if err := mirrorSSHCredential(ctx, c.cluster, basedir, sshCredential); err != nil {
			return err
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the underlying FindSSHPublicKeys error first (RBAC or connectivity)
2. Verify service account permissions for sshcredentials.kops.k8s.io in CI
3. Retry mirroring if the cause was a transient API server error
4. If no SSH keys are needed, note that a clean 404 is tolerated — only real errors block mirroring

Example fix

// before
if err := store.MirrorTo(ctx, basedir); err != nil { return err }
// after
if err := store.MirrorTo(ctx, basedir); err != nil {
	if strings.Contains(err.Error(), "timeout") {
		return store.MirrorTo(ctx, basedir) // one retry for transient API issues
	}
	return err
}

// probe mirror precondition: can we read ssh credentials?
if _, err := clientset.SSHCredentials(ns).Get(ctx, "admin", metav1.GetOptions{}); err != nil && !apierrors.IsNotFound(err) {
	return fmt.Errorf("mirror precondition failed: %w", err)
}

if err := store.MirrorTo(ctx, basedir); err != nil {
	if strings.Contains(err.Error(), "error listing SSHCredentials") {
		// transient API issue: retry once
		time.Sleep(2 * time.Second)
		return store.MirrorTo(ctx, basedir)
	}
	return err
}

When it happens

Trigger: Any operation that mirrors the state store (e.g. kOps commands reading config via MirrorTo) where the SSHCredential Get fails with a non-NotFound error: RBAC denial, API outage, timeouts.

Common situations: kops commands run against clusters with degraded API server access; CI jobs with restricted service accounts reading cluster state; mirroring to an external state store while API access is intermittent.

Related errors

• error reading SSHCredential: %v
• error creating SSHCredential: %v
• error updating SSHCredential: %v
• error deleting SSHCredential: %v
• error adding needs-update label: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9713adf2da66ac0e. Report an issue: GitHub.