kubernetes/kops · error

error replacing SSHCredential: %v

Error message

error replacing SSHCredential: %v

What it means

After resolving the cluster, `kops replace` obtains the cluster's SSH credential store and calls AddSSHPublicKey with the manifest's public key bytes. This error wraps any failure from that store operation — the key was not persisted.

Source

Thrown at cmd/kops/replace.go:219

				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {
					return err
				}

				sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
				if err != nil {
					return err
				}

				sshKeyArr := []byte(v.Spec.PublicKey)
				err = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)
				if err != nil {
					return fmt.Errorf("error replacing SSHCredential: %v", err)
				}
			default:
				klog.V(2).Infof("Type of object was %T", v)
				return fmt.Errorf("unhandled kind %q in %q", gvk, f)
			}
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v error to identify the backend cause.
2. Verify state store access and write permissions for SSH credentials.
3. Re-authenticate cloud credentials and retry if transient.
4. Confirm the cluster name is correct — the store is cluster-scoped and a wrong name may point to a non-writable location.

// Confirm write access to the state store before credential changes
if _, err := os.Stat(kopsStatePath); err != nil {
    return fmt.Errorf("cannot access state store: %v", err)
}
// and confirm cloud creds: aws sts get-caller-identity

if strings.HasPrefix(err.Error(), "error replacing SSHCredential:") {
    // backend write failed: refresh creds, then retry once
    refreshCloudCreds()
    return retryAddSSHPublicKey(ctx, key)
}

When it happens

Trigger: sshCredentialStore.AddSSHPublicKey returns an error: backend failure writing to the key store (state store / keystore implementation), permission denied, or network failure to the backing service.

Common situations: State store backend outage or throttling; insufficient IAM/bucket permissions to write SSH credentials; cluster resolved via a misconfigured KOPS_STATE_STORE; stale credentials on the machine running kops.

Related errors

• error loading NodeupConfig %q: %v
• error querying cluster %q: %v
• error getting cluster: %q: %v
• listing keysets: %v
• error storing user provided keys %q %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/68c198f3b28e4441. Report an issue: GitHub.