kubernetes/kops · error

listing SSH credentials %v

Error message

listing SSH credentials %v

What it means

RunGetSSHPublicKeys lists public keys via sshCredentialStore.FindSSHPublicKeys(). If the underlying store (typically the cluster's keyStore backed by the state store) fails to enumerate keys, the error is wrapped as "listing SSH credentials %v". This is a read failure on the credentials store, not a per-key problem.

Source

Thrown at cmd/kops/get_sshpublickeys.go:92

	if err != nil {
		return err
	}

	cluster, err := clientset.GetCluster(ctx, options.ClusterName)
	if err != nil {
		return err
	}

	sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
	if err != nil {
		return err
	}

	var items []*SSHKeyItem

	l, err := sshCredentialStore.FindSSHPublicKeys()
	if err != nil {
		return fmt.Errorf("listing SSH credentials %v", err)
	}

	for _, key := range l {
		id, err := sshcredentials.Fingerprint(key.Spec.PublicKey)
		if err != nil {
			klog.Warningf("unable to compute fingerprint for public key")
		}
		item := &SSHKeyItem{
			ID:        id,
			PublicKey: key.Spec.PublicKey,
		}

		items = append(items, item)
	}

	switch options.Output {

	case OutputTable:

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error after 'listing SSH credentials' — it names the real cause
2. Verify --state points at the correct store and credentials are valid (e.g. aws s3 ls <bucket>)
3. Check network connectivity/permissions to the state store backend
4. Retry if the failure was transient (timeout, throttling)

# verify state store reachability first
aws s3 ls "$(kops get clusters --state "$STATE" -o json | jq -r '.[0].configBase')" >/dev/null || { echo 'state store unreachable'; exit 1; }

if err := runGetSSHPublicKeys(opts); err != nil {
	if isTransient(err) { // timeout/throttle per wrapped error
		time.Sleep(backoff); retry()
	}
	return err
}

When it happens

Trigger: `kops get sshpublickeys` when the state store is unreachable (bad --state flag, missing cloud credentials), the sshpublickey object storage is corrupted, or a network error occurs while reading the store.

Common situations: Wrong or missing --state s3 bucket; expired AWS credentials; offline runs against a remote state store; permission denied on the state store object.

Related errors

• error adding SSH public key: %v
• error deleting SSH public key: %v
• error creating cluster: %v
• error querying cluster %q: %v
• must specify %q label with cluster name to create SSHCredent

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e12612941f55ca0f. Report an issue: GitHub.