kubernetes/kops · error

error reading SSH public key %v: %v

Error message

error reading SSH public key %v: %v

What it means

Returned by `kops create secret sshpublickey` when `os.ReadFile` fails to read the SSH public key file at `options.PublicKeyPath`. The raw bytes of the public key are needed to store it in the cluster's SSH credential store; the wrapped OS error explains why the read failed.

Source

Thrown at cmd/kops/create_sshpublickey.go:94

func RunCreateSSHPublicKey(ctx context.Context, f *util.Factory, out io.Writer, options *CreateSSHPublicKeyOptions) error {
	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return err
	}

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
	if err != nil {
		return err
	}

	data, err := os.ReadFile(options.PublicKeyPath)
	if err != nil {
		return fmt.Errorf("error reading SSH public key %v: %v", options.PublicKeyPath, err)
	}

	err = sshCredentialStore.AddSSHPublicKey(ctx, data)
	if err != nil {
		return fmt.Errorf("error adding SSH public key: %v", err)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the path with `ls -l <path>` and correct typos; use an absolute path.
2. Ensure you pass the PUBLIC key file (e.g. id_rsa.pub / id_ed25519.pub), not the private key.
3. Fix file permissions so the running user can read the key.

Example fix

// before
kops create secret sshpublickey --name c.example.com -i ~/.ssh/id_rsa
// after
kops create secret sshpublickey --name c.example.com -i ~/.ssh/id_rsa.pub

const fs = require('fs');
if (!fs.existsSync(pubKeyPath) || !fs.statSync(pubKeyPath).isFile()) {
  throw new Error(`SSH public key file not found: ${pubKeyPath}`);
}

function isReadableFile(p) {
  try { return require('fs').statSync(p).isFile(); } catch { return false; }
}

try {
  runKops(['create','secret','sshpublickey', cluster, '-i', pubKeyPath]);
} catch (e) {
  if (/error reading SSH public key/.test(e.message)) {
    console.error(`Cannot read ${pubKeyPath}; check path/permissions.`);
  }
  throw e;
}

When it happens

Trigger: Running `kops create secret sshpublickey --name <cluster> -i <path>` where the `-i`/`--pubkey` path doesn't exist, is a directory, or is unreadable by the current user.

Common situations: Passing the private key path or a path that doesn't exist; using `~/.ssh/id_rsa.pub` from a machine without that key; relative path from a different working directory; permission errors on shared CI runners.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• must specify %q label with cluster name to create SSHCredent
• spec.PublicKey is required
• error reading user provided private key %q: %v
• reading encryption config %v: %v
• error adding SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/70d2d1d9f1c09407. Report an issue: GitHub.