kubernetes/kops · error

error reading SSHCredential: %v

Error message

error reading SSHCredential: %v

What it means

addSSHCredential first GETs the 'admin' SSHCredential from the cluster via the clientset. If Get fails with an error other than IsNotFound, it returns 'error reading SSHCredential: %v'. Only a clean 404 is treated as 'does not exist yet'.

Source

Thrown at upup/pkg/fi/clientset_castore.go:266

		}
	} else {
		if _, err := client.Update(ctx, kopsKeyset, metav1.UpdateOptions{}); err != nil {
			return fmt.Errorf("error updating keyset %q: %v", name, err)
		}
	}
	return nil
}

// addSSHCredential saves the specified SSH Credential to the registry, doing an update or insert
func (c *ClientsetCAStore) addSSHCredential(ctx context.Context, publicKey string) error {
	create := false
	client := c.clientset.SSHCredentials(c.namespace)
	sshCredential, err := client.Get(ctx, "admin", metav1.GetOptions{})
	if err != nil {
		if errors.IsNotFound(err) {
			sshCredential = nil
		} else {
			return fmt.Errorf("error reading SSHCredential: %v", err)
		}
	}
	if sshCredential == nil {
		sshCredential = &kops.SSHCredential{}
		sshCredential.Name = "admin"
		create = true
	}
	sshCredential.Spec.PublicKey = publicKey
	if create {
		if _, err := client.Create(ctx, sshCredential, metav1.CreateOptions{}); err != nil {
			return fmt.Errorf("error creating SSHCredential: %v", err)
		}
	} else {
		if _, err := client.Update(ctx, sshCredential, metav1.UpdateOptions{}); err != nil {
			return fmt.Errorf("error updating SSHCredential: %v", err)
		}
	}
	return nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v error to distinguish authz (Forbidden) from connectivity
2. Confirm RBAC grants get on sshcredentials.kops.k8s.io in the kops namespace
3. Verify cluster/API server connectivity with kubectl
4. Retry the AddSSHPublicKey command after transient network issues

Example fix

// before
err := store.AddSSHPublicKey(ctx, pub)
// after
if err := store.AddSSHPublicKey(ctx, pub); err != nil {
	if strings.Contains(err.Error(), "forbidden") {
		return fmt.Errorf("grant RBAC get on sshcredentials.kops.k8s.io: %w", err)
	}
	return err
}

// verify read access before AddSSHPublicKey
if _, err := clientset.SSHCredentials(ns).Get(ctx, "admin", metav1.GetOptions{}); err != nil && !apierrors.IsNotFound(err) {
	return fmt.Errorf("precondition failed: %w", err)
}

func isNotFound(err error) bool { return apierrors.IsNotFound(err) }

if err := store.AddSSHPublicKey(ctx, pub); err != nil {
	if !isNotFound(err) { log.Printf("read sshcredential failed: %v", err) }
	return err
}

When it happens

Trigger: AddSSHPublicKey invoked while `client.Get(ctx, "admin", ...)` fails: API server unreachable, RBAC denies get on sshcredentials.kops.k8s.io, malformed request, or timeout.

Common situations: Running `kops create sshpublickey` with a kubeconfig lacking RBAC rights; API server down or behind a broken load balancer; wrong --state/namespace so the resource group is invalid.

Related errors

• error querying namespace %q: %v
• error listing nodes: %v
• error getting host %v: %w
• error listing Keysets: %v
• error updating keyset %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bf26f4507d932006. Report an issue: GitHub.