kubernetes/kops · error

error reading %q: %w

Error message

error reading %q: %w

What it means

Reading the private key file for NewAuthenticatorFromFile failed at the OS level (missing file, permissions, or I/O error); %q is the path passed to the authenticator constructor, before any parsing is attempted.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:94

		return "", fmt.Errorf("error converting public key to x509: %w", err)
	}

	var b bytes.Buffer
	if err := pem.Encode(&b, &pem.Block{Type: "PUBLIC KEY", Bytes: pkData}); err != nil {
		return "", fmt.Errorf("error encoding public key: %w", err)
	}
	return b.String(), nil
}

func NewAuthenticatorFromFile(p string) (bootstrap.Authenticator, error) {
	hostname, err := os.Hostname()
	if err != nil {
		return nil, fmt.Errorf("couldn't determine hostname: %w", err)
	}

	keyBytes, err := os.ReadFile(p)
	if err != nil {
		return nil, fmt.Errorf("error reading %q: %w", p, err)
	}
	key, err := pki.ParsePEMPrivateKey(keyBytes)
	if err != nil {
		return nil, fmt.Errorf("error parsing key from %q: %w", p, err)
	}

	return NewAuthenticator(hostname, key.Key)
}

func (a *pkiAuthenticator) CreateToken(body []byte) (string, error) {
	requestHash := sha256.Sum256(body)

	data := AuthTokenData{
		Timestamp:   time.Now().Unix(),
		Audience:    AudienceNodeAuthentication,
		RequestHash: requestHash[:],

		KeyID:    a.keyID,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the key file path exists and is readable by the process (check mode/ownership)
2. Correct the path given to the authenticator/keyset configuration
3. Restore the key file from the state store or reissue the keypair if corrupted

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:94 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0caac451f26754f7. Report an issue: GitHub.