{"record":{"id":"89b6c3d2ab44f13d","repo":"kubernetes/kops","slug":"error-computing-key-fingerprint-for-ssh-key-v-89b6c3","errorCode":null,"errorMessage":"error computing key fingerprint for SSH key: %v","messagePattern":"error computing key fingerprint for SSH key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/sshkey.go","lineNumber":82,"sourceCode":"\t\tklog.V(2).Infof(\"SSH key fingerprints match; assuming public keys match\")\n\t\tactual.PublicKey = e.PublicKey\n\t} else {\n\t\tklog.V(2).Infof(\"Computed SSH key fingerprint mismatch: %q %q\", fi.ValueOf(e.KeyFingerprint), fi.ValueOf(actual.KeyFingerprint))\n\t}\n\tactual.Lifecycle = e.Lifecycle\n\treturn actual, nil\n}\n\nfunc (e *SSHKey) Normalize(c *fi.CloudupContext) error {\n\tif e.KeyFingerprint == nil && e.PublicKey != nil {\n\t\tpublicKey, err := fi.ResourceAsString(e.PublicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading SSH public key: %v\", err)\n\t\t}\n\n\t\tkeyFingerprint, err := pki.ComputeOpenSSHKeyFingerprint(publicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error computing key fingerprint for SSH key: %v\", err)\n\t\t}\n\t\tklog.V(2).Infof(\"Computed SSH key fingerprint as %q\", keyFingerprint)\n\t\te.KeyFingerprint = &keyFingerprint\n\t}\n\treturn nil\n}\n\nfunc (e *SSHKey) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {\n\tif a == nil {\n\t\tif e.Name == nil {\n\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t} else {\n\t\tif changes.Name != nil {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/sshkey.go#L64-L100","documentation":"During the Normalize phase of the OpenStack SSHKey task, kOps computes the OpenSSH fingerprint of the configured public key (via pki.ComputeOpenSSHKeyFingerprint) when no fingerprint has been set yet. This error wraps any failure from that computation, meaning the key material in e.PublicKey could not be read into a valid format or parsed as an SSH public key.","triggerScenarios":"SSHKey task has KeyFingerprint == nil and PublicKey != nil, and either fi.ResourceAsString fails to render the key resource, or the rendered string is not a parseable OpenSSH-format public key (e.g. garbage, empty, PEM/private key, or unsupported format) so ComputeOpenSSHKeyFingerprint returns an error.","commonSituations":"Cluster config points at a keypair file that contains a private key or certificate instead of the .pub file; the ssh key path in the cluster spec is wrong so an empty/HTML error page is read; a key generated with a format unsupported by the parser (e.g. some RFC4716 or corrupted key); manually edited cluster yaml pasting a mangled single-line key.","solutions":["Verify the cluster spec's sshPublicKey points to a valid OpenSSH public key file (the .pub file, one line starting with ssh-rsa/ssh-ed25519/etc.); regenerate with `ssh-keygen -t ed25519` if in doubt.","Run `ssh-keygen -lf <file>` locally to confirm the file parses and has a fingerprint.","Ensure the file is readable and contains no HTML/error output (check you didn't download a 404 page as the key).","If the key is fine but still failing, update kOps — pki.ComputeOpenSSHKeyFingerprint has gained support for more key types over time."],"exampleFix":"# before: pointing at the private key\nsshPublicKey: file:///home/user/.ssh/id_ed25519\n# after: pointing at the public key\nsshPublicKey: file:///home/user/.ssh/id_ed25519.pub","handlingStrategy":"validation","validationCode":"// Before running kops, validate the key parses and has a fingerprint:\npub, err := os.ReadFile(pubKeyPath)\nif err != nil { return fmt.Errorf(\"cannot read public key %s: %w\", pubKeyPath, err) }\nif _, _, _, _, err := ssh.ParseAuthorizedKey(bytes.TrimSpace(pub)); err != nil {\n\treturn fmt.Errorf(\"%s is not a valid OpenSSH public key: %w\", pubKeyPath, err)\n}\n_, err = pki.ComputeOpenSSHKeyFingerprint(string(pub))\nif err != nil { return fmt.Errorf(\"fingerprint computation failed for %s: %w\", pubKeyPath, err) }","typeGuard":"func isOpenSSHPublicKey(s string) bool {\n\t_, _, _, _, err := ssh.ParseAuthorizedKey([]byte(strings.TrimSpace(s)))\n\treturn err == nil && (strings.HasPrefix(s, \"ssh-\") || strings.HasPrefix(s, \"ecdsa-\"))\n}","tryCatchPattern":null,"preventionTips":["Always reference the .pub file, never the private key, in the cluster spec.","Sanity-check with `ssh-keygen -lf <file>` before `kops update cluster`.","Use modern key types (ed25519/rsa) generated by OpenSSH; avoid RFC4716 exports.","Keep kOps current for broader key-format support in ComputeOpenSSHKeyFingerprint."],"tags":["openstack","ssh","keypair","fingerprint"],"backgroundTag":"ssh-key-parse-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}