{"record":{"id":"30b09da8766b305f","repo":"kubernetes/kops","slug":"error-rendering-ssh-key-data-w","errorCode":null,"errorMessage":"error rendering SSH key data: %w","messagePattern":"error rendering SSH key data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/linodetasks/instance.go","lineNumber":274,"sourceCode":"\ttruncatedHash := fullHashString[:maxLength]\n\n\treturn truncatedHash\n}\n\n// resolveAuthorizedKeys resolves the authorized keys for the instance.\n// It checks if the key has a public key directly provided or if it needs to be looked up by name in Akamai (Linode).\nfunc resolveAuthorizedKeys(client linode.LinodeClient, keys []*SSHKey) ([]string, error) {\n\tvar authorizedKeys []string\n\tvar keysByName map[string]string\n\n\tfor _, key := range keys {\n\t\tif key == nil {\n\t\t\tcontinue\n\t\t}\n\t\tif key.PublicKey != nil {\n\t\t\tpublicKey, err := fi.ResourceAsString(*key.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error rendering SSH key data: %w\", err)\n\t\t\t}\n\t\t\tauthorizedKeys = append(authorizedKeys, strings.TrimSpace(publicKey))\n\t\t\tcontinue\n\t\t}\n\n\t\tif keysByName == nil {\n\t\t\tlistedKeys, err := client.ListSSHKeys(context.TODO(), nil)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error listing Akamai (Linode) SSH keys: %w\", err)\n\t\t\t}\n\t\t\tkeysByName = make(map[string]string, len(listedKeys))\n\t\t\tfor _, listedKey := range listedKeys {\n\t\t\t\tkeysByName[listedKey.Label] = listedKey.SSHKey\n\t\t\t}\n\t\t}\n\n\t\tpublicKey, found := keysByName[fi.ValueOf(key.Name)]\n\t\tif !found {","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/linodetasks/instance.go#L256-L292","documentation":"resolveAuthorizedKeys turns the task's SSHKey resources into key strings. When a key carries its public key as an inline resource, it renders the resource to a string; this wraps any rendering failure.","triggerScenarios":"fi.ResourceAsString fails on key.PublicKey — typically when the resource references a file that cannot be read or is otherwise unresolvable at render time.","commonSituations":"AuthorizedKeys entries pointing to a local file path that doesn't exist on the machine running kops, or an unreadable/empty key file.","solutions":["Check that the file backing the PublicKey resource exists and is readable","Verify the authorized_keys entries in the cluster spec use correct paths or inline content","Re-run after fixing the key source"],"exampleFix":"// before\nauthorizedKeys:\n  - path: /nonexistent/id_ed25519.pub\n// after\nauthorizedKeys:\n  - path: ~/.ssh/id_ed25519.pub","handlingStrategy":"validation","validationCode":"// before apply, ensure each authorized key file is readable\nfor _, p := range keyPaths {\n    if _, err := os.ReadFile(p); err != nil { return fmt.Errorf(\"ssh key %s unreadable: %w\", p, err) }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute or verified-relative paths for key files","Prefer inline key content over file references in CI","Check file permissions for the user running kops"],"tags":["ssh","linode","resource-rendering"],"backgroundTag":"resource-read-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}