adding generated core

pkg/apis/kops/register.go

@@ -83,4 +83,4 @@ func (obj *Federation) GetObjectKind() schema.ObjectKind {
 }
 func (obj *SSHSecret) GetObjectKind() schema.ObjectKind {
 	return &obj.TypeMeta
-}
+}

pkg/apis/kops/v1alpha1/zz_generated.conversion.go

@@ -123,6 +123,12 @@ func RegisterConversions(scheme *runtime.Scheme) error {
 		Convert_kops_NetworkingSpec_To_v1alpha1_NetworkingSpec,
 		Convert_v1alpha1_RBACAuthorizationSpec_To_kops_RBACAuthorizationSpec,
 		Convert_kops_RBACAuthorizationSpec_To_v1alpha1_RBACAuthorizationSpec,
+		Convert_v1alpha1_SSHSecret_To_kops_SSHSecret,
+		Convert_kops_SSHSecret_To_v1alpha1_SSHSecret,
+		Convert_v1alpha1_SSHSecretList_To_kops_SSHSecretList,
+		Convert_kops_SSHSecretList_To_v1alpha1_SSHSecretList,
+		Convert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec,
+		Convert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec,
 		Convert_v1alpha1_WeaveNetworkingSpec_To_kops_WeaveNetworkingSpec,
 		Convert_kops_WeaveNetworkingSpec_To_v1alpha1_WeaveNetworkingSpec,
 	)
@@ -2158,6 +2164,96 @@ func Convert_kops_RBACAuthorizationSpec_To_v1alpha1_RBACAuthorizationSpec(in *ko
 	return autoConvert_kops_RBACAuthorizationSpec_To_v1alpha1_RBACAuthorizationSpec(in, out, s)
 }
 
+func autoConvert_v1alpha1_SSHSecret_To_kops_SSHSecret(in *SSHSecret, out *kops.SSHSecret, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1alpha1_SSHSecret_To_kops_SSHSecret is an autogenerated conversion function.
+func Convert_v1alpha1_SSHSecret_To_kops_SSHSecret(in *SSHSecret, out *kops.SSHSecret, s conversion.Scope) error {
+	return autoConvert_v1alpha1_SSHSecret_To_kops_SSHSecret(in, out, s)
+}
+
+func autoConvert_kops_SSHSecret_To_v1alpha1_SSHSecret(in *kops.SSHSecret, out *SSHSecret, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_kops_SSHSecret_To_v1alpha1_SSHSecret is an autogenerated conversion function.
+func Convert_kops_SSHSecret_To_v1alpha1_SSHSecret(in *kops.SSHSecret, out *SSHSecret, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecret_To_v1alpha1_SSHSecret(in, out, s)
+}
+
+func autoConvert_v1alpha1_SSHSecretList_To_kops_SSHSecretList(in *SSHSecretList, out *kops.SSHSecretList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]kops.SSHSecret, len(*in))
+		for i := range *in {
+			if err := Convert_v1alpha1_SSHSecret_To_kops_SSHSecret(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = make([]kops.SSHSecret, 0)
+	}
+	return nil
+}
+
+// Convert_v1alpha1_SSHSecretList_To_kops_SSHSecretList is an autogenerated conversion function.
+func Convert_v1alpha1_SSHSecretList_To_kops_SSHSecretList(in *SSHSecretList, out *kops.SSHSecretList, s conversion.Scope) error {
+	return autoConvert_v1alpha1_SSHSecretList_To_kops_SSHSecretList(in, out, s)
+}
+
+func autoConvert_kops_SSHSecretList_To_v1alpha1_SSHSecretList(in *kops.SSHSecretList, out *SSHSecretList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]SSHSecret, len(*in))
+		for i := range *in {
+			if err := Convert_kops_SSHSecret_To_v1alpha1_SSHSecret(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = make([]SSHSecret, 0)
+	}
+	return nil
+}
+
+// Convert_kops_SSHSecretList_To_v1alpha1_SSHSecretList is an autogenerated conversion function.
+func Convert_kops_SSHSecretList_To_v1alpha1_SSHSecretList(in *kops.SSHSecretList, out *SSHSecretList, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecretList_To_v1alpha1_SSHSecretList(in, out, s)
+}
+
+func autoConvert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec(in *SSHSecretSpec, out *kops.SSHSecretSpec, s conversion.Scope) error {
+	out.SshPublicKey = in.SshPublicKey
+	out.Username = in.Username
+	return nil
+}
+
+// Convert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec is an autogenerated conversion function.
+func Convert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec(in *SSHSecretSpec, out *kops.SSHSecretSpec, s conversion.Scope) error {
+	return autoConvert_v1alpha1_SSHSecretSpec_To_kops_SSHSecretSpec(in, out, s)
+}
+
+func autoConvert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec(in *kops.SSHSecretSpec, out *SSHSecretSpec, s conversion.Scope) error {
+	out.SshPublicKey = in.SshPublicKey
+	out.Username = in.Username
+	return nil
+}
+
+// Convert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec is an autogenerated conversion function.
+func Convert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec(in *kops.SSHSecretSpec, out *SSHSecretSpec, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecretSpec_To_v1alpha1_SSHSecretSpec(in, out, s)
+}
+
 func autoConvert_v1alpha1_WeaveNetworkingSpec_To_kops_WeaveNetworkingSpec(in *WeaveNetworkingSpec, out *kops.WeaveNetworkingSpec, s conversion.Scope) error {
 	out.MTU = in.MTU
 	return nil

pkg/apis/kops/v1alpha2/zz_generated.conversion.go

@@ -127,6 +127,12 @@ func RegisterConversions(scheme *runtime.Scheme) error {
 		Convert_kops_NetworkingSpec_To_v1alpha2_NetworkingSpec,
 		Convert_v1alpha2_RBACAuthorizationSpec_To_kops_RBACAuthorizationSpec,
 		Convert_kops_RBACAuthorizationSpec_To_v1alpha2_RBACAuthorizationSpec,
+		Convert_v1alpha2_SSHSecret_To_kops_SSHSecret,
+		Convert_kops_SSHSecret_To_v1alpha2_SSHSecret,
+		Convert_v1alpha2_SSHSecretList_To_kops_SSHSecretList,
+		Convert_kops_SSHSecretList_To_v1alpha2_SSHSecretList,
+		Convert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec,
+		Convert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec,
 		Convert_v1alpha2_TopologySpec_To_kops_TopologySpec,
 		Convert_kops_TopologySpec_To_v1alpha2_TopologySpec,
 		Convert_v1alpha2_WeaveNetworkingSpec_To_kops_WeaveNetworkingSpec,
@@ -2266,6 +2272,96 @@ func Convert_kops_RBACAuthorizationSpec_To_v1alpha2_RBACAuthorizationSpec(in *ko
 	return autoConvert_kops_RBACAuthorizationSpec_To_v1alpha2_RBACAuthorizationSpec(in, out, s)
 }
 
+func autoConvert_v1alpha2_SSHSecret_To_kops_SSHSecret(in *SSHSecret, out *kops.SSHSecret, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1alpha2_SSHSecret_To_kops_SSHSecret is an autogenerated conversion function.
+func Convert_v1alpha2_SSHSecret_To_kops_SSHSecret(in *SSHSecret, out *kops.SSHSecret, s conversion.Scope) error {
+	return autoConvert_v1alpha2_SSHSecret_To_kops_SSHSecret(in, out, s)
+}
+
+func autoConvert_kops_SSHSecret_To_v1alpha2_SSHSecret(in *kops.SSHSecret, out *SSHSecret, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_kops_SSHSecret_To_v1alpha2_SSHSecret is an autogenerated conversion function.
+func Convert_kops_SSHSecret_To_v1alpha2_SSHSecret(in *kops.SSHSecret, out *SSHSecret, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecret_To_v1alpha2_SSHSecret(in, out, s)
+}
+
+func autoConvert_v1alpha2_SSHSecretList_To_kops_SSHSecretList(in *SSHSecretList, out *kops.SSHSecretList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]kops.SSHSecret, len(*in))
+		for i := range *in {
+			if err := Convert_v1alpha2_SSHSecret_To_kops_SSHSecret(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = make([]kops.SSHSecret, 0)
+	}
+	return nil
+}
+
+// Convert_v1alpha2_SSHSecretList_To_kops_SSHSecretList is an autogenerated conversion function.
+func Convert_v1alpha2_SSHSecretList_To_kops_SSHSecretList(in *SSHSecretList, out *kops.SSHSecretList, s conversion.Scope) error {
+	return autoConvert_v1alpha2_SSHSecretList_To_kops_SSHSecretList(in, out, s)
+}
+
+func autoConvert_kops_SSHSecretList_To_v1alpha2_SSHSecretList(in *kops.SSHSecretList, out *SSHSecretList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]SSHSecret, len(*in))
+		for i := range *in {
+			if err := Convert_kops_SSHSecret_To_v1alpha2_SSHSecret(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = make([]SSHSecret, 0)
+	}
+	return nil
+}
+
+// Convert_kops_SSHSecretList_To_v1alpha2_SSHSecretList is an autogenerated conversion function.
+func Convert_kops_SSHSecretList_To_v1alpha2_SSHSecretList(in *kops.SSHSecretList, out *SSHSecretList, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecretList_To_v1alpha2_SSHSecretList(in, out, s)
+}
+
+func autoConvert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec(in *SSHSecretSpec, out *kops.SSHSecretSpec, s conversion.Scope) error {
+	out.SshPublicKey = in.SshPublicKey
+	out.Username = in.Username
+	return nil
+}
+
+// Convert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec is an autogenerated conversion function.
+func Convert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec(in *SSHSecretSpec, out *kops.SSHSecretSpec, s conversion.Scope) error {
+	return autoConvert_v1alpha2_SSHSecretSpec_To_kops_SSHSecretSpec(in, out, s)
+}
+
+func autoConvert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec(in *kops.SSHSecretSpec, out *SSHSecretSpec, s conversion.Scope) error {
+	out.SshPublicKey = in.SshPublicKey
+	out.Username = in.Username
+	return nil
+}
+
+// Convert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec is an autogenerated conversion function.
+func Convert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec(in *kops.SSHSecretSpec, out *SSHSecretSpec, s conversion.Scope) error {
+	return autoConvert_kops_SSHSecretSpec_To_v1alpha2_SSHSecretSpec(in, out, s)
+}
+
 func autoConvert_v1alpha2_TopologySpec_To_kops_TopologySpec(in *TopologySpec, out *kops.TopologySpec, s conversion.Scope) error {
 	out.Masters = in.Masters
 	out.Nodes = in.Nodes

pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKops) InstanceGroups(namespace string) internalversion.InstanceGrou
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKops) SSHSecrets(namespace string) internalversion.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKops) RESTClient() rest.Interface {

pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	kops "k8s.io/kops/pkg/apis/kops"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKops
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &kops.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &kops.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *kops.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &kops.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &kops.SSHSecretList{}
+	for _, item := range obj.(*kops.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}

pkg/client/clientset_generated/clientset/typed/kops/internalversion/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/clientset/typed/kops/internalversion/kops_client.go

@@ -26,6 +26,7 @@ type KopsInterface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsClient is used to interact with features provided by the kops group.
@@ -45,6 +46,10 @@ func (c *KopsClient) InstanceGroups(namespace string) InstanceGroupInterface {
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsClient) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsClient for the given config.
 func NewForConfig(c *rest.Config) (*KopsClient, error) {
 	config := *c

pkg/client/clientset_generated/clientset/typed/kops/internalversion/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	kops "k8s.io/kops/pkg/apis/kops"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/clientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*kops.SSHSecret) (*kops.SSHSecret, error)
+	Update(*kops.SSHSecret) (*kops.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*kops.SSHSecret, error)
+	List(opts v1.ListOptions) (*kops.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsClient, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *kops.SSHSecretList, err error) {
+	result = &kops.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKopsV1alpha1) InstanceGroups(namespace string) v1alpha1.InstanceGro
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKopsV1alpha1) SSHSecrets(namespace string) v1alpha1.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKopsV1alpha1) RESTClient() rest.Interface {

pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/kops/pkg/apis/kops/v1alpha1"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKopsV1alpha1
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "v1alpha1", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "v1alpha1", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &v1alpha1.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *v1alpha1.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &v1alpha1.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.SSHSecretList{}
+	for _, item := range obj.(*v1alpha1.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/kops_client.go

@@ -28,6 +28,7 @@ type KopsV1alpha1Interface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsV1alpha1Client is used to interact with features provided by the kops group.
@@ -47,6 +48,10 @@ func (c *KopsV1alpha1Client) InstanceGroups(namespace string) InstanceGroupInter
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsV1alpha1Client) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsV1alpha1Client for the given config.
 func NewForConfig(c *rest.Config) (*KopsV1alpha1Client, error) {
 	config := *c

pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha1 "k8s.io/kops/pkg/apis/kops/v1alpha1"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/clientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*v1alpha1.SSHSecret) (*v1alpha1.SSHSecret, error)
+	Update(*v1alpha1.SSHSecret) (*v1alpha1.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha1.SSHSecret, error)
+	List(opts v1.ListOptions) (*v1alpha1.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsV1alpha1Client, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *v1alpha1.SSHSecretList, err error) {
+	result = &v1alpha1.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKopsV1alpha2) InstanceGroups(namespace string) v1alpha2.InstanceGro
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKopsV1alpha2) SSHSecrets(namespace string) v1alpha2.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKopsV1alpha2) RESTClient() rest.Interface {

pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "k8s.io/kops/pkg/apis/kops/v1alpha2"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKopsV1alpha2
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "v1alpha2", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "v1alpha2", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &v1alpha2.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *v1alpha2.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &v1alpha2.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.SSHSecretList{}
+	for _, item := range obj.(*v1alpha2.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/kops_client.go

@@ -28,6 +28,7 @@ type KopsV1alpha2Interface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsV1alpha2Client is used to interact with features provided by the kops group.
@@ -47,6 +48,10 @@ func (c *KopsV1alpha2Client) InstanceGroups(namespace string) InstanceGroupInter
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsV1alpha2Client) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsV1alpha2Client for the given config.
 func NewForConfig(c *rest.Config) (*KopsV1alpha2Client, error) {
 	config := *c

pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "k8s.io/kops/pkg/apis/kops/v1alpha2"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/clientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*v1alpha2.SSHSecret) (*v1alpha2.SSHSecret, error)
+	Update(*v1alpha2.SSHSecret) (*v1alpha2.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha2.SSHSecret, error)
+	List(opts v1.ListOptions) (*v1alpha2.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsV1alpha2Client, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *v1alpha2.SSHSecretList, err error) {
+	result = &v1alpha2.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKops) InstanceGroups(namespace string) internalversion.InstanceGrou
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKops) SSHSecrets(namespace string) internalversion.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKops) RESTClient() rest.Interface {

pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	kops "k8s.io/kops/pkg/apis/kops"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKops
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &kops.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &kops.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *kops.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &kops.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &kops.SSHSecretList{}
+	for _, item := range obj.(*kops.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &kops.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*kops.SSHSecret), err
+}

pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/kops_client.go

@@ -26,6 +26,7 @@ type KopsInterface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsClient is used to interact with features provided by the kops group.
@@ -45,6 +46,10 @@ func (c *KopsClient) InstanceGroups(namespace string) InstanceGroupInterface {
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsClient) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsClient for the given config.
 func NewForConfig(c *rest.Config) (*KopsClient, error) {
 	config := *c

pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	kops "k8s.io/kops/pkg/apis/kops"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/internalclientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*kops.SSHSecret) (*kops.SSHSecret, error)
+	Update(*kops.SSHSecret) (*kops.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*kops.SSHSecret, error)
+	List(opts v1.ListOptions) (*kops.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsClient, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *kops.SSHSecret) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *kops.SSHSecretList, err error) {
+	result = &kops.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *kops.SSHSecret, err error) {
+	result = &kops.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKopsV1alpha1) InstanceGroups(namespace string) v1alpha1.InstanceGro
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKopsV1alpha1) SSHSecrets(namespace string) v1alpha1.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKopsV1alpha1) RESTClient() rest.Interface {

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/kops/pkg/apis/kops/v1alpha1"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKopsV1alpha1
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "v1alpha1", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "v1alpha1", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &v1alpha1.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *v1alpha1.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &v1alpha1.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.SSHSecretList{}
+	for _, item := range obj.(*v1alpha1.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &v1alpha1.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.SSHSecret), err
+}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/kops_client.go

@@ -28,6 +28,7 @@ type KopsV1alpha1Interface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsV1alpha1Client is used to interact with features provided by the kops group.
@@ -47,6 +48,10 @@ func (c *KopsV1alpha1Client) InstanceGroups(namespace string) InstanceGroupInter
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsV1alpha1Client) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsV1alpha1Client for the given config.
 func NewForConfig(c *rest.Config) (*KopsV1alpha1Client, error) {
 	config := *c

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha1 "k8s.io/kops/pkg/apis/kops/v1alpha1"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/internalclientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*v1alpha1.SSHSecret) (*v1alpha1.SSHSecret, error)
+	Update(*v1alpha1.SSHSecret) (*v1alpha1.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha1.SSHSecret, error)
+	List(opts v1.ListOptions) (*v1alpha1.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsV1alpha1Client, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *v1alpha1.SSHSecret) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *v1alpha1.SSHSecretList, err error) {
+	result = &v1alpha1.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.SSHSecret, err error) {
+	result = &v1alpha1.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_kops_client.go

@@ -38,6 +38,10 @@ func (c *FakeKopsV1alpha2) InstanceGroups(namespace string) v1alpha2.InstanceGro
 	return &FakeInstanceGroups{c, namespace}
 }
 
+func (c *FakeKopsV1alpha2) SSHSecrets(namespace string) v1alpha2.SSHSecretInterface {
+	return &FakeSSHSecrets{c, namespace}
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeKopsV1alpha2) RESTClient() rest.Interface {

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_sshsecret.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "k8s.io/kops/pkg/apis/kops/v1alpha2"
+)
+
+// FakeSSHSecrets implements SSHSecretInterface
+type FakeSSHSecrets struct {
+	Fake *FakeKopsV1alpha2
+	ns   string
+}
+
+var sshsecretsResource = schema.GroupVersionResource{Group: "kops", Version: "v1alpha2", Resource: "sshsecrets"}
+
+var sshsecretsKind = schema.GroupVersionKind{Group: "kops", Version: "v1alpha2", Kind: "SSHSecret"}
+
+func (c *FakeSSHSecrets) Create(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Update(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(sshsecretsResource, c.ns, sSHSecret), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(sshsecretsResource, c.ns, name), &v1alpha2.SSHSecret{})
+
+	return err
+}
+
+func (c *FakeSSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(sshsecretsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.SSHSecretList{})
+	return err
+}
+
+func (c *FakeSSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(sshsecretsResource, c.ns, name), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}
+
+func (c *FakeSSHSecrets) List(opts v1.ListOptions) (result *v1alpha2.SSHSecretList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(sshsecretsResource, sshsecretsKind, c.ns, opts), &v1alpha2.SSHSecretList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.SSHSecretList{}
+	for _, item := range obj.(*v1alpha2.SSHSecretList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *FakeSSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(sshsecretsResource, c.ns, opts))
+
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *FakeSSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(sshsecretsResource, c.ns, name, data, subresources...), &v1alpha2.SSHSecret{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.SSHSecret), err
+}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/generated_expansion.go

@@ -21,3 +21,5 @@ type ClusterExpansion interface{}
 type FederationExpansion interface{}
 
 type InstanceGroupExpansion interface{}
+
+type SSHSecretExpansion interface{}

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/kops_client.go

@@ -28,6 +28,7 @@ type KopsV1alpha2Interface interface {
 	ClustersGetter
 	FederationsGetter
 	InstanceGroupsGetter
+	SSHSecretsGetter
 }
 
 // KopsV1alpha2Client is used to interact with features provided by the kops group.
@@ -47,6 +48,10 @@ func (c *KopsV1alpha2Client) InstanceGroups(namespace string) InstanceGroupInter
 	return newInstanceGroups(c, namespace)
 }
 
+func (c *KopsV1alpha2Client) SSHSecrets(namespace string) SSHSecretInterface {
+	return newSSHSecrets(c, namespace)
+}
+
 // NewForConfig creates a new KopsV1alpha2Client for the given config.
 func NewForConfig(c *rest.Config) (*KopsV1alpha2Client, error) {
 	config := *c

pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/sshsecret.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "k8s.io/kops/pkg/apis/kops/v1alpha2"
+	scheme "k8s.io/kops/pkg/client/clientset_generated/internalclientset/scheme"
+)
+
+// SSHSecretsGetter has a method to return a SSHSecretInterface.
+// A group's client should implement this interface.
+type SSHSecretsGetter interface {
+	SSHSecrets(namespace string) SSHSecretInterface
+}
+
+// SSHSecretInterface has methods to work with SSHSecret resources.
+type SSHSecretInterface interface {
+	Create(*v1alpha2.SSHSecret) (*v1alpha2.SSHSecret, error)
+	Update(*v1alpha2.SSHSecret) (*v1alpha2.SSHSecret, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha2.SSHSecret, error)
+	List(opts v1.ListOptions) (*v1alpha2.SSHSecretList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error)
+	SSHSecretExpansion
+}
+
+// sSHSecrets implements SSHSecretInterface
+type sSHSecrets struct {
+	client rest.Interface
+	ns     string
+}
+
+// newSSHSecrets returns a SSHSecrets
+func newSSHSecrets(c *KopsV1alpha2Client, namespace string) *sSHSecrets {
+	return &sSHSecrets{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Create takes the representation of a sSHSecret and creates it.  Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Create(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a sSHSecret and updates it. Returns the server's representation of the sSHSecret, and an error, if there is any.
+func (c *sSHSecrets) Update(sSHSecret *v1alpha2.SSHSecret) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(sSHSecret.Name).
+		Body(sSHSecret).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the sSHSecret and deletes it. Returns an error if one occurs.
+func (c *sSHSecrets) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *sSHSecrets) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Get takes name of the sSHSecret, and returns the corresponding sSHSecret object, and an error if there is any.
+func (c *sSHSecrets) Get(name string, options v1.GetOptions) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of SSHSecrets that match those selectors.
+func (c *sSHSecrets) List(opts v1.ListOptions) (result *v1alpha2.SSHSecretList, err error) {
+	result = &v1alpha2.SSHSecretList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested sSHSecrets.
+func (c *sSHSecrets) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Patch applies the patch and returns the patched sSHSecret.
+func (c *sSHSecrets) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.SSHSecret, err error) {
+	result = &v1alpha2.SSHSecret{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("sshsecrets").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}