{"record":{"id":"968e0b9609185f14","repo":"kubernetes/kops","slug":"error-reading-ssh-public-key-v-968e0b","errorCode":null,"errorMessage":"error reading SSH public key: %v","messagePattern":"error reading SSH public key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/sshkey.go","lineNumber":77,"sourceCode":"\t\tKeyFingerprint: new(rs.Fingerprint),\n\t}\n\n\t// Avoid spurious changes\n\tif fi.ValueOf(actual.KeyFingerprint) == fi.ValueOf(e.KeyFingerprint) {\n\t\tklog.V(2).Infof(\"SSH key fingerprints match; assuming public keys match\")\n\t\tactual.PublicKey = e.PublicKey\n\t} else {\n\t\tklog.V(2).Infof(\"Computed SSH key fingerprint mismatch: %q %q\", fi.ValueOf(e.KeyFingerprint), fi.ValueOf(actual.KeyFingerprint))\n\t}\n\tactual.Lifecycle = e.Lifecycle\n\treturn actual, nil\n}\n\nfunc (e *SSHKey) Normalize(c *fi.CloudupContext) error {\n\tif e.KeyFingerprint == nil && e.PublicKey != nil {\n\t\tpublicKey, err := fi.ResourceAsString(e.PublicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading SSH public key: %v\", err)\n\t\t}\n\n\t\tkeyFingerprint, err := pki.ComputeOpenSSHKeyFingerprint(publicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error computing key fingerprint for SSH key: %v\", err)\n\t\t}\n\t\tklog.V(2).Infof(\"Computed SSH key fingerprint as %q\", keyFingerprint)\n\t\te.KeyFingerprint = &keyFingerprint\n\t}\n\treturn nil\n}\n\nfunc (e *SSHKey) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {\n\tif a == nil {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/sshkey.go#L59-L95","documentation":"SSHKey.Normalize in the OpenStack tasks reads the configured SSH public key resource as a string via fi.ResourceAsString and fails when the resource cannot be read or decoded (file missing, unreadable, invalid path, bad bytes). kOps needs the public key text to compute its OpenSSH fingerprint before uploading the keypair to OpenStack.","triggerScenarios":"Normalize is invoked with e.KeyFingerprint == nil and e.PublicKey != nil, and fi.ResourceAsString(e.PublicKey) returns an error — typically the key file path in the cluster spec (--ssh-public-key / sshPublicKey) does not exist or is not readable, or the resource points to an empty/binary file.","commonSituations":"Running 'kops update cluster --ssh-public-key ~/.ssh/id_rsa.pub' where the file was never generated; a typo'd or relative path with wrong working directory; a private key (.pem) passed instead of the .pub; permission errors on the key file; cluster spec referencing a key path from another machine.","solutions":["Verify the public key file exists and is readable: 'cat <path>' — generate one with 'ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519' if missing.","Pass an absolute path: kops update cluster --ssh-public-key /home/user/.ssh/id_ed25519.pub.","Ensure you pass the .pub public key, not the private key file.","Check file permissions (chmod 644 on the public key) and that it is valid OpenSSH one-line format."],"exampleFix":"// before\nkops update cluster --name my.cluster --ssh-public-key ~/.ssh/id_rsa\n// after (public key, absolute path)\nkops update cluster --name my.cluster --ssh-public-key /home/user/.ssh/id_rsa.pub","handlingStrategy":"validation","validationCode":"# Validate the SSH public key before running kops\nKEY=\"$HOME/.ssh/id_ed25519.pub\"\n[ -r \"$KEY\" ] || { echo \"key not readable: $KEY\"; exit 1; }\nssh-keygen -lf \"$KEY\" >/dev/null 2>&1 || { echo \"not a valid OpenSSH public key\"; exit 1; }","typeGuard":null,"tryCatchPattern":"// If driving the task directly\npublicKey, err := fi.ResourceAsString(e.PublicKey)\nif err != nil {\n    return fmt.Errorf(\"check --ssh-public-key path/readability: %v\", err)\n}","preventionTips":["Always pass the .pub public key with an absolute path to kops.","Generate a keypair with ssh-keygen if none exists; never point at private keys.","Confirm file readability for the user running kops (CI vs local user home differences).","Set sshPublicKey explicitly in the cluster spec rather than relying on defaults."],"tags":["ssh","openstack","keypair","file-io"],"backgroundTag":"ssh-public-key-unreadable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}