kubernetes/kops · error

must specify %q label with cluster name to create SSHCredent

Error message

must specify %q label with cluster name to create SSHCredential

What it means

Same pattern as instance groups but for SSHCredential objects: RunCreate requires the `kops.k8s.io/cluster` (LabelClusterName) metadata label to route the credential to a cluster's SSH credential store; if absent the command returns this error.

Source

Thrown at cmd/kops/create.go:182

				}

				if cluster == nil {
					return fmt.Errorf("cluster %q not found", clusterName)
				}

				_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})
				if err != nil {
					if apierrors.IsAlreadyExists(err) {
						return fmt.Errorf("instanceGroup %q already exists", v.ObjectMeta.Name)
					}
					return fmt.Errorf("error creating instanceGroup: %v", err)
				}
				fmt.Fprintf(&sb, "Created instancegroup/%s\n", v.ObjectMeta.Name)

			case *kopsapi.SSHCredential:
				clusterName = v.ObjectMeta.Labels[kopsapi.LabelClusterName]
				if clusterName == "" {
					return fmt.Errorf("must specify %q label with cluster name to create SSHCredential", kopsapi.LabelClusterName)
				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {
					return err
				}

				sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
				if err != nil {
					return err
				}

				sshKeyArr := []byte(v.Spec.PublicKey)
				err = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)
				if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add `kops.k8s.io/cluster: <cluster-name>` to metadata.labels of the SSHCredential document
2. Alternatively upload the key with `kops create secret sshpublickey admin -f pubkey` targeting --name <cluster>
3. Verify the label key spelling matches kops.k8s.io/cluster

Example fix

# before
kind: SSHCredential
metadata:
  name: admin
# after
kind: SSHCredential
metadata:
  name: admin
  labels:
    kops.k8s.io/cluster: mycluster.example.com

if v, ok := obj.(*kopsapi.SSHCredential); ok && v.ObjectMeta.Labels[kopsapi.LabelClusterName] == "" {
    return fmt.Errorf("SSHCredential %s missing label %s", v.Name, kopsapi.LabelClusterName)
}

func labeledSSHCredential(o runtime.Object) (*kopsapi.SSHCredential, bool) {
    c, ok := o.(*kopsapi.SSHCredential)
    return c, ok && c.ObjectMeta.Labels[kopsapi.LabelClusterName] != ""
}

When it happens

Trigger: `kops create -f sshcred.yaml` where the kind: SSHCredential document lacks metadata.labels["kops.k8s.io/cluster"], or the label key is misspelled so it reads as empty.

Common situations: Hand-written SSH credential manifests; automation emitting SSHCredential specs without ObjectMeta labels; docs examples predating the label requirement.

Related errors

• must specify %q label with cluster name to create instanceGr
• spec.PublicKey is required
• error reading SSH public key %v: %v
• error adding SSH public key: %v
• use 'kops get sshpublickey' instead

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/038e6f44c99d640e. Report an issue: GitHub.