kubernetes/kops · error

writing file %q over SSH: %w

Error message

writing file %q over SSH: %w

What it means

While staging additional nodeup files listed in bootstrapData.NodeupScriptAdditionalFiles, writeFile copies each file's contents over the SSH connection to the target host. This error wraps whatever failure the SSH write encountered (I/O error on the SSH session, permission denied on the destination path, disk full).

Source

Thrown at pkg/commands/toolbox_enroll.go:241

	kubeClient, err := client.New(restConfigNoProto, client.Options{
		Scheme: scheme,
	})
	if err != nil {
		return fmt.Errorf("building kubernetes client: %w", err)
	}

	// We can't create the host resource in the API server for control-plane nodes,
	// because the API server (likely) isn't running yet.
	if !ig.IsControlPlane() {
		if err := kubeClient.Create(ctx, hostData); err != nil {
			return fmt.Errorf("failed to create host %s/%s: %w", hostData.Namespace, hostData.Name, err)
		}
	}

	for k, v := range bootstrapData.NodeupScriptAdditionalFiles {
		if err := sshTarget.writeFile(ctx, k, bytes.NewReader(v)); err != nil {
			return fmt.Errorf("writing file %q over SSH: %w", k, err)
		}
	}

	if len(bootstrapData.NodeupScript) != 0 {
		if _, err := sshTarget.runScript(ctx, string(bootstrapData.NodeupScript), ExecOptions{Echo: true}); err != nil {
			return err
		}
	}
	return nil
}

const scriptCreateKey = `
#!/bin/bash
set -o errexit
set -o nounset
set -o pipefail

set -x

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error: if permission denied, ensure the SSH user has passwordless sudo (visudo: user ALL=(ALL) NOPASSWD:ALL)
2. Check remote disk space: df -h on the target host
3. Verify network stability to the host and retry the enroll command
4. Confirm the destination file path is correct and not immutable (chattr +i)

Example fix

// before
if err := sshTarget.writeFile(ctx, k, bytes.NewReader(v)); err != nil {
    return fmt.Errorf("writing file %q over SSH: %w", k, err)
}
// after
if err := sshTarget.writeFile(ctx, k, bytes.NewReader(v)); err != nil {
    if strings.Contains(err.Error(), "permission denied") {
        return fmt.Errorf("writing file %q over SSH: permission denied; ensure SSH user has passwordless sudo: %w", k, err)
    }
    return fmt.Errorf("writing file %q over SSH: %w", k, err)
}

ssh <user>@<host> 'test -w /etc/kubernetes/kops && df -h /var | awk "NR==2{exit ($4+0>5)?0:1}"' \
  || echo "target not writable or low disk"

func sshWritable(ctx context.Context, h *SSHHost, dir string) bool {
    _, err := h.runCommand(ctx, "test -w "+dir, ExecOptions{Echo: false})
    return err == nil
}

if err := sshTarget.writeFile(ctx, k, bytes.NewReader(v)); err != nil {
    return fmt.Errorf("writing file %q over SSH: %w", k, err)
}

When it happens

Trigger: sshTarget.writeFile(ctx, k, bytes.NewReader(v)) fails for a specific file k: SSH session dropped, remote path not writable by the SSH user (even with sudo wrapper failing), or remote filesystem errors.

Common situations: Enrolling a node where /etc/kubernetes or the script's target dirs are root-owned and sudo is not correctly configured (no passwordless sudo for the user), full /var or /tmp partition, or flaky network killing the SSH session mid-transfer.

Related errors

• method DeleteSSHCredential not supported in server-side clie
• method AddSSHPublicKey not supported in server-side client
• must specify %q label with cluster name to create SSHCredent
• spec.PublicKey is required
• error reading SSH key file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4d1089c2573f189d. Report an issue: GitHub.