Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-75941

Kubernetes Credentials Provider Plugin does not load sshUserPrivateKey secrets—shows "No SecretToCredentialConverter found to convert secrets of type sshUserPrivateKey

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not A Defect
    • Icon: Minor Minor
    • kubernetes-credentials-provider-plugin
    • None

      Summary:
      Kubernetes Credentials Provider Plugin does not load sshUserPrivateKey secrets: "No SecretToCredentialConverter found to convert secrets of type sshUserPrivateKey"

      Description:
      After upgrading Jenkins and the Kubernetes Credentials Provider Plugin, Jenkins no longer loads SSH credentials from Kubernetes secrets of type sshUserPrivateKey. These credentials do not appear in the Jenkins credential store, and the following warning is shown in the logs:
      No SecretToCredentialConverter found to convert secrets of type sshUserPrivateKey

      Other credentials (username/password, secret text) load as expected. This issue persists across clean, stateless Jenkins deployments.

      Steps to Reproduce:

      1. Deploy Jenkins using the official jenkins/jenkins:lts or jenkins/jenkins:latest Docker image in Kubernetes.
      2. Install these plugins (latest versions as of July 2025):
        • kubernetes-credentials-provider
        • kubernetes-credentials
        • credentials
        • ssh-credentials
      3. Create a Kubernetes secret like this: 
        apiVersion: v1
kind: Secret
metadata:
name: my-ssh-key
namespace: jenkins
labels:
jenkins.io/credentials-type: sshUserPrivateKey
type: sshUserPrivateKey
data:
ssh-privatekey: (base64-encoded-private-key)
username: (base64-encoded-username) 
passphrase: (base64-encoded-passphrase)
      1. Start Jenkins and check the credentials store—SSH credentials are missing.
      2. Check the logs for the warning above.

      Expected Behavior:
      Jenkins should recognize the Kubernetes secret as an SSH credential and load it.

      Actual Behavior:
      Jenkins ignores the SSH secret and logs the warning about a missing SecretToCredentialConverter.

      Jenkins Version:
      lts-jdk17:latest

      Plugin Versions:

      • kubernetes-credentials-provider:latest
      • kubernetes-credentials:latest
      • credentials:latest
      • ssh-credentials:latest

      Kubernetes Version:
      k3s

      Deployment Method:
      YAML

      Additional Info:

      • Credentials of type username/password and secret text work as expected
      • The secret structure is correct and worked in previous plugin versions
      • Issue persists with clean deployments (no persistent volume or cache)
      • Tried older plugin versions as a workaround, but no success

      Logs:
      No SecretToCredentialConverter found to convert secrets of type sshUserPrivateKey

      Labels:
      kubernetes, credentials, ssh, kubernetes-credentials-provider-plugin, bug

            teilo James Nord
            loggod Torsten
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: