kubernetes/kops · error

error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer

Error message

error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer

What it means

GeneratePrivateKey reads the KOPS_RSA_PRIVATE_KEY_SIZE environment variable to override the default RSA key size (2048). If the value cannot be parsed as an integer by strconv.Atoi, generation aborts with this error instead of silently falling back.

Source

Thrown at pkg/pki/privatekey.go:59

func ParsePEMPrivateKey(data []byte) (*PrivateKey, error) {
	k, err := parsePEMPrivateKey(data)
	if err != nil {
		return nil, err
	}
	if k == nil {
		return nil, nil
	}
	return &PrivateKey{Key: k}, nil
}

func GeneratePrivateKey() (*PrivateKey, error) {
	rsaKeySize := DefaultPrivateKeySize

	if os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE") != "" {
		s := os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE")
		if v, err := strconv.Atoi(s); err != nil {
			return nil, fmt.Errorf("error parsing KOPS_RSA_PRIVATE_KEY_SIZE=%s as integer", s)
		} else {
			rsaKeySize = int(v)
			klog.V(4).Infof("Generating key of size %d, set by KOPS_RSA_PRIVATE_KEY_SIZE env var", rsaKeySize)
		}
	}

	rsaKey, err := rsa.GenerateKey(crypto_rand.Reader, rsaKeySize)
	if err != nil {
		return nil, fmt.Errorf("error generating RSA private key: %v", err)
	}

	privateKey := &PrivateKey{Key: rsaKey}
	return privateKey, nil
}

type PrivateKey struct {
	Key crypto.Signer
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set KOPS_RSA_PRIVATE_KEY_SIZE to a plain integer, e.g. export KOPS_RSA_PRIVATE_KEY_SIZE=4096.
2. Unset the variable to fall back to the default key size.
3. Check the exporting script for stray units, spaces, or CR characters.

Example fix

// before
export KOPS_RSA_PRIVATE_KEY_SIZE=4096bit
// after
export KOPS_RSA_PRIVATE_KEY_SIZE=4096

if s := os.Getenv("KOPS_RSA_PRIVATE_KEY_SIZE"); s != "" {
    if _, err := strconv.Atoi(s); err != nil {
        return fmt.Errorf("KOPS_RSA_PRIVATE_KEY_SIZE=%q is not an integer", s)
    }
}

When it happens

Trigger: Setting KOPS_RSA_PRIVATE_KEY_SIZE to a non-integer (e.g. "2048bit", "2k", "" handled earlier, so anything non-numeric like "abc" or "4096 ") before any call path that generates a key: createKeypair, IssueCert, BuildChallengeServerCertificate, or a Run entry point.

Common situations: CI scripts exporting KOPS_RSA_PRIVATE_KEY_SIZE with units or trailing characters; shell quoting issues injecting whitespace/extra chars; typo in the numeric value.

Understand the failure class

Background: "is not a valid" / "Invalid ... value" environment variable errors: how libraries validate env vars and what to do when they reject yours — this error's family across 48 libraries.

Related errors

• host %v did not have public-key
• failed to parse public key: %w
• unable to parse CNI plugin binaries asset URL %q: %v
• unable to parse CNI plugin binaries asset hash %q: %v
• unrecognized certificate option: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/39e0e157fdebf1be. Report an issue: GitHub.