kubernetes/kops · error

spec.PublicKey is required

Error message

spec.PublicKey is required

What it means

For SSHCredential objects, besides the cluster label, kOps requires spec.publicKey to contain the actual SSH public key material. An SSHCredential with an empty spec.publicKey cannot be stored, so RunCreate rejects it with this error.

Source

Thrown at cmd/kops/create.go:185

					return fmt.Errorf("cluster %q not found", clusterName)
				}

				_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})
				if err != nil {
					if apierrors.IsAlreadyExists(err) {
						return fmt.Errorf("instanceGroup %q already exists", v.ObjectMeta.Name)
					}
					return fmt.Errorf("error creating instanceGroup: %v", err)
				}
				fmt.Fprintf(&sb, "Created instancegroup/%s\n", v.ObjectMeta.Name)

			case *kopsapi.SSHCredential:
				clusterName = v.ObjectMeta.Labels[kopsapi.LabelClusterName]
				if clusterName == "" {
					return fmt.Errorf("must specify %q label with cluster name to create SSHCredential", kopsapi.LabelClusterName)
				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {
					return err
				}

				sshCredentialStore, err := clientset.SSHCredentialStore(cluster)
				if err != nil {
					return err
				}

				sshKeyArr := []byte(v.Spec.PublicKey)
				err = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)
				if err != nil {
					return err
				}
				fmt.Fprintf(&sb, "Added ssh credential\n")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Populate spec.publicKey with the SSH public key text (e.g. `ssh-rsa AAAA... user@host`)
2. Use `kops create secret sshpublickey admin -f ~/.ssh/id_rsa.pub --name <cluster>` instead
3. Check templating/CI variable substitution produced a non-empty key

Example fix

# before
spec:
  publicKey: ""
# after
spec:
  publicKey: "ssh-rsa AAAAB3Nza... me@laptop"

if strings.TrimSpace(sshCred.Spec.PublicKey) == "" {
    return fmt.Errorf("spec.publicKey must contain key material")
}
if !strings.HasPrefix(sshCred.Spec.PublicKey, "ssh-") {
    return fmt.Errorf("spec.publicKey does not look like an SSH public key")
}

When it happens

Trigger: `kops create -f sshcred.yaml` where the SSHCredential document has `spec: {}` or `spec.publicKey: ""` — e.g. the key was templated out, the file was truncated, or a placeholder was never substituted.

Common situations: CI secret-injection failure leaving the publicKey field empty; YAML generated by a script that skipped embedding the key; copying an example manifest that omitted the key body.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• error adding SSH public key: %v
• must specify %q label with cluster name to create SSHCredent
• adding keypair to %q is not supported
• unable to parse YAML %v: %v
• error reading SSH public key %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/69a2615229779944. Report an issue: GitHub.