kubernetes/kops · error

parsing %q key: %v

Error message

parsing %q key: %v

What it means

newKeystore parses the previously read <name>.key bytes as a PEM private key; this wraps pki.ParsePEMPrivateKey failing, meaning the key file exists but does not contain a valid PEM private key (wrong format, corrupted, or a cert in its place).

Source

Thrown at cmd/kops-controller/pkg/server/keystore.go:100

	}
	for _, name := range cas {
		certBytes, err := os.ReadFile(path.Join(basePath, name+".crt"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q certificate: %v", name, err)
		}
		// TODO: Support multiple certificates?
		certificate, err := pki.ParsePEMCertificate(certBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q certificate: %v", name, err)
		}

		keyBytes, err := os.ReadFile(path.Join(basePath, name+".key"))
		if err != nil {
			return nil, nil, fmt.Errorf("reading %q key: %v", name, err)
		}
		key, err := pki.ParsePEMPrivateKey(keyBytes)
		if err != nil {
			return nil, nil, fmt.Errorf("parsing %q key: %v", name, err)
		}

		keystore.keys[name] = keystoreEntry{
			certificate: certificate,
			key:         key,
		}
	}

	var keypairIDs map[string]string
	keypairIDsBytes, err := os.ReadFile(path.Join(basePath, "keypair-ids.yaml"))
	if err != nil {
		return nil, nil, fmt.Errorf("reading keypair-ids.yaml")
	}
	if err := yaml.Unmarshal(keypairIDsBytes, &keypairIDs); err != nil {
		return nil, nil, fmt.Errorf("parsing keypair-ids.yaml")
	}

	// Build keysets

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the .key file actually contains a PEM private key
2. Regenerate the CA keypair if the key is corrupted
3. Ensure the correct file was placed as <name>.key

When it happens

Trigger: Thrown at cmd/kops-controller/pkg/server/keystore.go:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f67ac5a03b57518f. Report an issue: GitHub.