# GCS backup failure: private key should be a PEM or plain PKCS1 or PKCS8

**URL:** <https://forums.percona.com/t/gcs-backup-failure-private-key-should-be-a-pem-or-plain-pkcs1-or-pkcs8/39612>\
**Category:** Percona Operator for MongoDB\
**Created:** [October 25, 2025, 3:27pm UTC](https://forums.percona.com/t/gcs-backup-failure-private-key-should-be-a-pem-or-plain-pkcs1-or-pkcs8/39612 "2025-10-25T15:27:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Dutra](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/alex_dutra/32/22438_2.png) [@Alex\_Dutra](https://forums.percona.com/u/Alex_Dutra)\
**Post date:** [October 25, 2025, 3:27pm UTC](https://forums.percona.com/t/gcs-backup-failure-private-key-should-be-a-pem-or-plain-pkcs1-or-pkcs8/39612/1 "2025-10-25T15:27:00Z")

</div>

## Description:

Hi,

I’m trying to perform backups using GCS. I’m using operator 1.21.0 and following the instructions here:

> **[Percona Operator for MongoDB - Configure storage for backups](https://docs.percona.com/percona-operator-for-mongodb/backups-storage.html#google-cloud-storage)**
>
> You can configure storage for backups in the backup.storages subsection of the
> Custom Resource, using the deploy/cr.yaml  
> configuration file.

However the backups fail with this message: “private key should be a PEM or plain PKCS1 or PKCS8” (see logs below).

The error comes from Google SDK:

> <https://github.com/googleapis/google-cloud-go/blob/612e608d8b000d0564bd4fbe7619bfa60de232ff/auth/internal/internal.go#L96>

I’m fairly confident my private key was a valid RSA PKCS8 PEM-encoded key. I tried to provide the key with and without PEM headers, with and without newlines, nothing worked.

## Steps to Reproduce:

1. Setup service accounts and create an GKE cluster
2. Create a secret with GCS\_CLIENT\_EMAIL and GCS\_PRIVATE\_KEY as explained in the docs
3. Create a CR with:

```auto
  backup:
    enabled: true
    storages:
      my-backups:
        gcs:
          bucket: my-bucket
          credentialsSecret: my-secret
          prefix: path/to/backups
        main: true
        type: gcs

```

## Version:

MongoDB Operator: 1.21.0

PBM: 2.11.0

## Logs:

PBM agent logs:

```auto
check failed with: file stat: list with parts for mw file stat op: fetching pbm file parts base: get properties: Get "https://storage.googleapis.com/storage/v1/b/.../.pbm.init?alt=json&prettyPrint=false&projection=full": private key should be a PEM or plain PKCS1 or PKCS8: asn1: structure error: tags don't match (16 vs {class:0 tag:13 length:45 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2

```

## Expected Result:

Backup success.

## Actual Result:

Backup failed.

## Additional Information:

None

---

<div class="post-metadata">

**Author:** ![Alex\_Dutra](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/alex_dutra/32/22438_2.png) [@Alex\_Dutra](https://forums.percona.com/u/Alex_Dutra)\
**Post date:** [October 26, 2025, 3:33pm UTC](https://forums.percona.com/t/gcs-backup-failure-private-key-should-be-a-pem-or-plain-pkcs1-or-pkcs8/39612/2 "2025-10-26T15:33:47Z")

</div>

UPDATE: my bad, the private key string was being fetched from a secret and was in single-line form with `\n` escape sequences, and these where undistinguishable from real line breaks in my text editor. When I replaced the escape sequences with actual line breaks, the key was successfully decoded.

---

<div class="post-metadata">

**Author:** ![Slava\_Sarzhan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/slava_sarzhan/32/3196_2.png) [@Slava\_Sarzhan](https://forums.percona.com/u/Slava_Sarzhan)\
**Post date:** [November 30, 2025, 4:39pm UTC](https://forums.percona.com/t/gcs-backup-failure-private-key-should-be-a-pem-or-plain-pkcs1-or-pkcs8/39612/3 "2025-11-30T16:39:32Z")

</div>

@Alex_Dutra thanks for update