kubernetes/kops · error

public key %s: %v

Error message

public key %s: %v

What it means

Keyset.ToCertificateBytes serializes the certificate of every item in a keyset into one buffer. If item.Certificate.AsBytes() fails for any keyset item, it returns 'public key %s: %v' where %s is the keyset item id — meaning a stored certificate cannot be re-encoded (typically malformed PEM/DER data in the underlying store).

Source

Thrown at upup/pkg/fi/ca.go:150

func (k *Keyset) ToCertificateBytes() ([]byte, error) {
	keys := make([]string, 0, len(k.Items))
	for k, item := range k.Items {
		if item.DistrustTimestamp == nil {
			keys = append(keys, k)
		}
	}
	sort.Slice(keys, func(i, j int) bool {
		return KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)
	})

	buf := new(bytes.Buffer)
	for _, key := range keys {
		item := k.Items[key]
		if item.Certificate != nil {
			certificate, err := item.Certificate.AsBytes()
			if err != nil {
				return nil, fmt.Errorf("public key %s: %v", item.Id, err)
			}
			buf.Write(certificate)
		}
	}
	return buf.Bytes(), nil
}

func (k *Keyset) ToPublicKeys() (string, error) {
	keys := make([]string, 0, len(k.Items))
	for k, item := range k.Items {
		if item.DistrustTimestamp == nil {
			keys = append(keys, k)
		}
	}
	sort.Slice(keys, func(i, j int) bool {
		return KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Identify the failing item from %s (item id) and inspect the certificate it references in the keyset store.
2. Replace the bad certificate with a freshly issued one (kOps replace/rotate secret or re-run cluster CA/cert creation).
3. Restore the keyset from backup/state store history if corruption is recent.
4. Re-encode/validate the cert with openssl x509 to confirm it parses before re-importing.

Example fix

// validate the stored certificate out-of-band
$ openssl x509 -in <item-cert>.pem -noout -text   # rejects the corrupt item
# then re-issue/rotate the certificate via kOps and re-run

$ openssl x509 -in <item-cert>.pem -noout -text   # must parse cleanly before use
$ openssl x509 -in <item-cert>.pem -noout -enddate  # also confirm not expired

function isCertNil(item: { Certificate: object | null }): item is { Certificate: null } { return item.Certificate === null }

try {
  const bytes = keyset.toCertificateBytes()
} catch (e) {
  if (/public key .*: /.test(e.message)) {
    const itemId = e.message.match(/public key (\S+):/)?.[1] // locate corrupt item
    console.error("corrupt certificate in keyset item:", itemId)
    // replace/rotate that item's certificate and retry
  }
  throw e
}

When it happens

Trigger: setResources -> Keyset.ToCertificateBytes when an item in the keyset holds a Certificate whose AsBytes encoding fails — corrupted or unsupported certificate data in the backing store (e.g. file-backed or keyset store).

Common situations: Manually edited or partially written certificate files in the keyset store; a migration/version change left an item in an incompatible format; truncated write during an earlier failed update.

Related errors

• failed to read %q certificates: %w
• failed to get keyset from %q
• key %q not found
• marshalling public key %s: %v
• encoding public key %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/73d8ba0c0b1be36b. Report an issue: GitHub.