kubernetes/kops · error

spec.PublicKey is required

Error message

spec.PublicKey is required

What it means

An SSHCredential manifest must carry the public key in spec.publicKey. `kops replace` validates this before contacting the credential store; an empty Spec.PublicKey means there is nothing to add, so the command fails fast with this message.

Source

Thrown at cmd/kops/replace.go:203

				case nil:
					klog.Infof("instanceGroup: %v was not found, creating resource now", igName)
					_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})
					if err != nil {
						return fmt.Errorf("error creating instanceGroup: %v", err)
					}
				default:
					_, err = clientset.InstanceGroupsFor(cluster).Update(ctx, v, metav1.UpdateOptions{})
					if err != nil {
						return fmt.Errorf("error replacing instanceGroup: %v", err)
					}
				}
			case *kopsapi.SSHCredential:
				clusterName := v.ObjectMeta.Labels[kopsapi.LabelClusterName]
				if clusterName == "" {
					return fmt.Errorf("must specify %q label with cluster name to replace SSHCredential", kopsapi.LabelClusterName)
				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {
					return err
				}

				sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
				if err != nil {
					return err
				}

				sshKeyArr := []byte(v.Spec.PublicKey)
				err = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)
				if err != nil {
					return fmt.Errorf("error replacing SSHCredential: %v", err)
				}
			default:

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set spec.publicKey to the full OpenSSH public key string (e.g. `ssh-rsa AAAA... user@host`).
2. Verify the YAML parses correctly: `kops replace -f ssh.yaml --dry-run` or inspect with `yq '.spec.publicKey'`.
3. Regenerate the key if lost: `ssh-keygen -t ed25519` and paste the .pub content.
4. Use `kops create sshpublickey --pubkey ~/.ssh/id_ed25519.pub` as an alternative path.

Example fix

# before
spec: {}
# after
spec:
  publicKey: "ssh-ed25519 AAAAC3Nza... user@host"

func publicKeyPresent(spec kops.SSHCredentialSpec) error {
    if strings.TrimSpace(spec.PublicKey) == "" {
        return fmt.Errorf("spec.publicKey must contain an OpenSSH public key")
    }
    return nil
}

When it happens

Trigger: Applying an SSHCredential YAML where `spec.publicKey` is empty, omitted, or contains only whitespace (the byte conversion yields an empty key).

Common situations: Templating mistake that drops the key field; piping a file that failed to load; writing `publicKey: ""` placeholder and forgetting to fill it; YAML indentation placing the key under the wrong field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• must specify %q label with cluster name to replace SSHCreden
• expected exactly one object in manifest %s, found %d
• failed to parse objects: %w
• failed to parse apiVersion %q
• failed to find kind in object

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b2934972fb337e04. Report an issue: GitHub.