kubernetes/kops · error

error writing SSL PrivateKey: %v

Error message

error writing SSL PrivateKey: %v

What it means

AsBytes() wraps any failure from PrivateKey.WriteTo() when serializing the key into a PEM bytes.Buffer. The underlying error is almost always an encoding failure reported by WriteTo (e.g. unknown key type); this message just contextualizes it for callers writing SSL private keys.

Source

Thrown at pkg/pki/privatekey.go:102

	var data bytes.Buffer
	_, err := k.WriteTo(&data)
	if err != nil {
		return "", fmt.Errorf("error writing SSL private key: %v", err)
	}
	return data.String(), nil
}

func (k *PrivateKey) AsBytes() ([]byte, error) {
	// Nicer behaviour because this is called from templates
	if k == nil {
		return nil, fmt.Errorf("AsBytes called on nil private key")
	}

	var data bytes.Buffer
	_, err := k.WriteTo(&data)
	if err != nil {
		return nil, fmt.Errorf("error writing SSL PrivateKey: %v", err)
	}
	return data.Bytes(), nil
}

func (k *PrivateKey) UnmarshalJSON(b []byte) (err error) {
	s := ""
	if err := json.Unmarshal(b, &s); err == nil {
		r, err := parsePEMPrivateKey([]byte(s))
		if err != nil {
			// Alternative form: Check if base64 encoded
			// TODO: Do we need this?  I think we need this only on nodeup, but maybe we could just not base64-it?
			d, err2 := base64.StdEncoding.DecodeString(s)
			if err2 == nil {
				r2, err2 := parsePEMPrivateKey(d)
				if err2 == nil {
					klog.Warningf("used base64 decode of PrivateKey")
					r = r2
					err = nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error: if it says 'unknown private key type: %T', the key algorithm is unsupported — convert or regenerate as RSA/ECDSA.
2. Regenerate the key with pki.GeneratePrivateKey() (RSA) so WriteTo can encode it.
3. If the key must be preserved, convert the signer to an RSA or ECDSA key before storing it in PrivateKey.Key.

Example fix

// before (ed25519 key from PKCS8)
out, _ := key.AsBytes()
// after
switch key.Key.(type) {
case *rsa.PrivateKey, *ecdsa.PrivateKey:
    out, err := key.AsBytes()
    if err != nil { return err }
default:
    return fmt.Errorf("unsupported key type; regenerate as RSA or ECDSA")
}

switch key.Key.(type) {
case *rsa.PrivateKey, *ecdsa.PrivateKey:
    // ok
default:
    return fmt.Errorf("unsupported private key type %T", key.Key)
}

func isSerializableKey(k *pki.PrivateKey) bool {
    if k == nil { return false }
    switch k.Key.(type) {
    case *rsa.PrivateKey, *ecdsa.PrivateKey:
        return true
    }
    return false
}

b, err := key.AsBytes()
if err != nil {
    var unsupported = strings.Contains(err.Error(), "unknown private key type")
    // regenerate or convert key if unsupported
    return fmt.Errorf("AsBytes: %w", err)
}

When it happens

Trigger: Calling AsBytes() on a PrivateKey whose Key field is a crypto.Signer that is neither *rsa.PrivateKey nor *ecdsa.PrivateKey (e.g. ed25519 from a PKCS8 parse), causing WriteTo to fail with 'unknown private key type'.

Common situations: Storing keys parsed from PKCS8 'PRIVATE KEY' PEM blocks using ed25519, then serializing via AsBytes; using keys generated by other tooling with unsupported algorithms; template rendering of certificates/secrets that embeds the key.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• error writing SSL private key: %v
• AsString called on nil private key
• AsBytes called on nil private key
• unknown private key type: %T
• could not parse private key (unable to decode PEM)

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f88bdc16837ea7b0. Report an issue: GitHub.