kubernetes/kops · error

unsupported public key type for service-account: %T

Error message

unsupported public key type for service-account: %T

What it means

Type guard in findJWKSForServiceAccount: the service-account signing key fetched from the secret store is not an *rsa.PublicKey (only RSA keys are supported for building the JWKS), so a key JSON web key cannot be produced.

Source

Thrown at nodeup/pkg/model/discovery_service.go:154

			// }

			// hasher := crypto.SHA256.New()
			// hasher.Write(publicKeyDERBytes)
			// publicKeyDERHash := hasher.Sum(nil)

			// jwk.KeyID = base64.RawURLEncoding.EncodeToString(publicKeyDERHash)
		}

		switch publicKey := publicKey.(type) {
		case *rsa.PublicKey:
			jwk.Algorithm = "RS256"
			jwk.Use = "sig"
			jwk.N = base64.RawURLEncoding.EncodeToString(publicKey.N.Bytes())
			jwk.E = base64.RawURLEncoding.EncodeToString(uint64ToBytes(uint64(publicKey.E)))
			jwk.KeyType = "RSA"

		default:
			return nil, fmt.Errorf("unsupported public key type for service-account: %T", publicKey)
		}

		jwks = append(jwks, jwk)
	}
	sort.Slice(jwks, func(i, j int) bool {
		return jwks[i].KeyID < jwks[j].KeyID
	})

	return jwks, nil
}

func uint64ToBytes(n uint64) []byte {
	data := make([]byte, 8)
	binary.BigEndian.PutUint64(data, n)
	return bytes.TrimLeft(data, "\x00")
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the service-account keypair as RSA
2. Check the service-account secret in the state store
3. Rotate with kops create secret

When it happens

Trigger: Thrown at nodeup/pkg/model/discovery_service.go:154 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/69ea98fc13c9d9aa. Report an issue: GitHub.