{"record":{"id":"4adc311fe6fc5dec","repo":"kubernetes/kops","slug":"error-rendering-sshkey-publickey-v","errorCode":null,"errorMessage":"error rendering SSHKey PublicKey: %v","messagePattern":"error rendering SSHKey PublicKey: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/sshkey.go","lineNumber":162,"sourceCode":"\t\t\treturn fi.CannotChangeField(\"Name\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (e *SSHKey) createKeypair(cloud awsup.AWSCloud) error {\n\tctx := context.TODO()\n\tklog.V(2).Infof(\"Creating SSHKey with Name:%q\", *e.Name)\n\n\trequest := &ec2.ImportKeyPairInput{\n\t\tKeyName:           e.Name,\n\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeKeyPair, e.Tags),\n\t}\n\n\tif e.PublicKey != nil {\n\t\td, err := fi.ResourceAsBytes(e.PublicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error rendering SSHKey PublicKey: %v\", err)\n\t\t}\n\t\trequest.PublicKeyMaterial = d\n\t}\n\n\tresponse, err := cloud.EC2().ImportKeyPair(ctx, request)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error creating SSHKey: %v\", err)\n\t}\n\n\te.KeyFingerprint = response.KeyFingerprint\n\te.ID = response.KeyPairId\n\n\treturn nil\n}\n\nfunc (_ *SSHKey) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SSHKey) error {\n\tif a == nil {\n\t\treturn e.createKeypair(t.Cloud)","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/sshkey.go#L144-L180","documentation":"In createKeypair (RenderAWS), when the task specifies PublicKey, kOps renders it to bytes to send as PublicKeyMaterial to ec2.ImportKeyPair. If rendering the resource fails, the error \"error rendering SSHKey PublicKey\" is returned before any AWS call. This is a local resource-materialization failure, distinct from AWS rejecting the key.","triggerScenarios":"fi.ResourceAsBytes(e.PublicKey) errors: underlying resource (file/bytes/handler) unreadable or unresolved at render time — e.g. key content was supplied via a resource that depends on a failed earlier step.","commonSituations":"Pipeline where the public key was generated in a previous task that failed; file deleted between normalize and apply; programmatic use of kOps libraries with an incorrectly constructed resource.","solutions":["Read the wrapped cause and fix the underlying resource (path, permissions, resolution).","Ensure the public key file still exists and is readable when kops apply runs.","When using kOps programmatically, construct the resource with fi.NewStringResource or NewBytesResource with valid data.","Re-run the upstream step that generates the key before applying the SSHKey task."],"exampleFix":"// before\ne.PublicKey = fi.NewResource(\"/tmp/generated.pub\") // file removed earlier in pipeline\n// after\npub, err := os.ReadFile(\"/tmp/generated.pub\")\nif err != nil { return err }\ne.PublicKey = fi.NewBytesResource(pub)","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(pubKeyPath)\nif err != nil { return fmt.Errorf(\"public key %s unreadable before apply: %w\", pubKeyPath, err) }\nif len(bytes.TrimSpace(data)) == 0 { return fmt.Errorf(\"public key %s is empty\", pubKeyPath) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure key generation steps complete before the SSHKey task renders.","Keep key material in stable, readable locations.","When using kOps programmatically, build resources with fi.NewBytesResource from verified bytes."],"tags":["ssh","ec2","resource-render","import-key"],"backgroundTag":"resource-render-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}