{"record":{"id":"a788466f427f0f19","repo":"kubernetes/kops","slug":"error-fingerprinting-ssh-public-key-q-v","errorCode":null,"errorMessage":"error fingerprinting SSH public key %q: %v","messagePattern":"error fingerprinting SSH public key %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/vfs_castore.go","lineNumber":241,"sourceCode":"\t}\n\n\treturn nil\n}\n\n// mirrorKeyset writes Keyset bundles for the certificates & privatekeys.\nfunc mirrorKeyset(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, name string, keyset *Keyset) error {\n\tif err := writeKeysetBundle(ctx, cluster, basedir.Join(\"private\"), name, keyset); err != nil {\n\t\treturn fmt.Errorf(\"writing private bundle: %v\", err)\n\t}\n\n\treturn nil\n}\n\n// mirrorSSHCredential writes the SSH credential file to the mirror location\nfunc mirrorSSHCredential(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, sshCredential *kops.SSHCredential) error {\n\tid, err := sshcredentials.Fingerprint(sshCredential.Spec.PublicKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error fingerprinting SSH public key %q: %v\", sshCredential.Name, err)\n\t}\n\n\tp := basedir.Join(\"ssh\", \"public\", sshCredential.Name, id)\n\tacl, err := acls.GetACL(ctx, p, cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = p.WriteFile(ctx, bytes.NewReader([]byte(sshCredential.Spec.PublicKey)), acl)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error writing %q: %v\", p, err)\n\t}\n\n\treturn nil\n}\n\nfunc (c *VFSCAStore) StoreKeyset(ctx context.Context, name string, keyset *Keyset) error {\n\tif keyset.Primary == nil || keyset.Primary.Id == \"\" {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/vfs_castore.go#L223-L259","documentation":"mirrorSSHCredential fingerprints the SSH public key stored in an SSHCredential using sshcredentials.Fingerprint before writing it to the mirror path. If the stored PublicKey material is empty, malformed, or in an unsupported format, fingerprinting fails and this error wraps the reason along with the credential name.","triggerScenarios":"MirrorTo -> mirrorSSHCredential when a stored SSHCredential's Spec.PublicKey cannot be parsed/fingerprinted: empty key bytes, truncated key file, wrong key format (not an authorized_keys-style OpenSSH/SSH2 key), or encoding corruption.","commonSituations":"SSH public keys uploaded with unsupported formats or line-wrapping corruption; state store files truncated by failed uploads; credentials created by very old kops versions with legacy formats.","solutions":["Inspect the named SSHCredential's public key file in the state store for truncation/corruption and re-upload with `kops create sshpublickey`.","Ensure the key is in OpenSSH authorized_keys format (ssh-rsa AAAA... or ecdsa-sha2-...).","Remove or replace the malformed credential, then re-run the mirror.","Validate the key locally with `ssh-keygen -lf <keyfile>` before uploading to kops."],"exampleFix":"// before (corrupted/truncated key in state store)\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQ...[truncat\n// after: re-upload a complete key\nkops create sshpublickey admin -i ~/.ssh/id_rsa.pub --name mycluster","handlingStrategy":"validation","validationCode":"func validPublicKeyMaterial(pub string) error {\n\tif strings.TrimSpace(pub) == \"\" {\n\t\treturn fmt.Errorf(\"empty public key\")\n\t}\n\tif _, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pub)); err != nil {\n\t\treturn fmt.Errorf(\"not a valid authorized_keys entry: %w\", err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := mirrorSSHCredential(ctx, cluster, basedir, cred); err != nil {\n\tif strings.Contains(err.Error(), \"fingerprinting\") {\n\t\tlog.Printf(\"skipping corrupt SSH credential %q; re-upload with kops create sshpublickey\", cred.Name)\n\t\treturn nil // or abort, depending on policy\n\t}\n\treturn err\n}","preventionTips":["Validate keys with `ssh-keygen -lf` before `kops create sshpublickey`.","Avoid manual edits/transfers of key files inside the state store that can truncate them.","Periodically verify stored credentials fingerprint cleanly as a state-store health check."],"tags":["ssh","fingerprint","keystore","mirror"],"backgroundTag":"ssh-public-key-invalid","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}