kubernetes/kops · error

error parsing key from %q: %w

Error message

error parsing key from %q: %w

What it means

The key file at the quoted path was read successfully but its contents are not a PEM-encoded private key recognized by pki.ParsePEMPrivateKey — wrong file, a certificate/public key instead of a private key, or an unexpected PEM block type.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:98

	if err := pem.Encode(&b, &pem.Block{Type: "PUBLIC KEY", Bytes: pkData}); err != nil {
		return "", fmt.Errorf("error encoding public key: %w", err)
	}
	return b.String(), nil
}

func NewAuthenticatorFromFile(p string) (bootstrap.Authenticator, error) {
	hostname, err := os.Hostname()
	if err != nil {
		return nil, fmt.Errorf("couldn't determine hostname: %w", err)
	}

	keyBytes, err := os.ReadFile(p)
	if err != nil {
		return nil, fmt.Errorf("error reading %q: %w", p, err)
	}
	key, err := pki.ParsePEMPrivateKey(keyBytes)
	if err != nil {
		return nil, fmt.Errorf("error parsing key from %q: %w", p, err)
	}

	return NewAuthenticator(hostname, key.Key)
}

func (a *pkiAuthenticator) CreateToken(body []byte) (string, error) {
	requestHash := sha256.Sum256(body)

	data := AuthTokenData{
		Timestamp:   time.Now().Unix(),
		Audience:    AudienceNodeAuthentication,
		RequestHash: requestHash[:],

		KeyID:    a.keyID,
		Instance: a.hostname,
	}

	payload, err := json.Marshal(&data)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the file is a PEM private key (e.g. an 'EC PRIVATE KEY' or 'RSA PRIVATE KEY' block)
2. Regenerate the keypair and update the referenced file
3. Ensure the file was not truncated or otherwise corrupted

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:98 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e432f16658fc6952. Report an issue: GitHub.