{"record":{"id":"c7c46580de4bdb43","repo":"kubernetes/kops","slug":"unexpected-type-of-ssh-key-t-aws-can-only-impo","errorCode":null,"errorMessage":"unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys","messagePattern":"unexpected type of SSH key \\(%T\\); AWS can only import RSA and ed25519 keys","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/sshkey.go","lineNumber":88,"sourceCode":"func ComputeAWSKeyFingerprint(publicKey string) (string, error) {\n\tsshPublicKey, err := parseSSHPublicKey(publicKey)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tswitch sshPublicKey.Type() {\n\tcase ssh.KeyAlgoRSA:\n\t\tder, err := rsaToDER(sshPublicKey)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"error computing fingerprint for SSH public key: %v\", err)\n\t\t}\n\t\th := md5.Sum(der)\n\t\treturn colonSeparatedHex(h[:]), nil\n\tcase ssh.KeyAlgoED25519:\n\t\treturn ssh.FingerprintSHA256(sshPublicKey), nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys\", sshPublicKey)\n}\n\n// ComputeOpenSSHKeyFingerprint computes the OpenSSH fingerprint of the SSH public key\nfunc ComputeOpenSSHKeyFingerprint(publicKey string) (string, error) {\n\tsshPublicKey, err := parseSSHPublicKey(publicKey)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\th := md5.Sum(sshPublicKey.Marshal())\n\treturn colonSeparatedHex(h[:]), nil\n}\n\n// rsaToDER gets the DER encoding of the SSH public key\n// Annoyingly, the ssh code wraps the actual crypto keys, so we have to use reflection tricks\nfunc rsaToDER(pubkey ssh.PublicKey) ([]byte, error) {\n\tvar cryptoKey crypto.PublicKey\n\tvar rsaPublicKey *rsa.PublicKey","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/sshkey.go#L70-L106","documentation":"AWS key fingerprints in EC2 are MD5-based (RSA) or SHA256 (ed25519); other algorithms (e.g. ECDSA, DSA, or ssh certificates) are not supported, so ComputeAWSKeyFingerprint rejects the key by concrete Go type after parsing. The %T verb names the unsupported Go type.","triggerScenarios":"Computing the AWS fingerprint for an ssh-ed25519 is fine, but ecdsa-sha2-nistp256/384/521, ssh-dss, or sk-ecdsa keys reach the default fall-through return.","commonSituations":"Users importing ECDSA keys generated by `ssh-keygen -t ecdsa` and running kops commands that fingerprint keypairs (kops get/delete keypair workflows, ImportKeyPair, secret normalization).","solutions":["Generate or convert to an RSA or ed25519 key: `ssh-keygen -t ed25519` and re-import via `kops create secret sshpublickey`","Remove/replace the unsupported keypair entry in the keyset","If AWS import is not the goal, use ComputeOpenSSHKeyFingerprint, which handles all key types"],"exampleFix":"// before\nssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa\n// after\nssh-keygen -t ed25519 -f ~/.ssh/id_ed25519\nkops create secret sshpublickey admin -i ~/.ssh/id_ed25519.pub","handlingStrategy":"validation","validationCode":"func keyAlgorithmSupportedForAWS(pubKey string) bool {\n\tf := strings.Fields(pubKey)\n\tif len(f) == 0 {\n\t\treturn false\n\t}\n\treturn f[0] == \"ssh-rsa\" || f[0] == \"ssh-ed25519\"\n}\nif !keyAlgorithmSupportedForAWS(pubKey) {\n\treturn fmt.Errorf(\"AWS fingerprinting requires RSA or ed25519 keys\")\n}\nfp, err := pki.ComputeAWSKeyFingerprint(pubKey)","typeGuard":"func isAWSCompatibleKey(token string) bool {\n\treturn token == \"ssh-rsa\" || token == \"ssh-ed25519\"\n}","tryCatchPattern":"fp, err := pki.ComputeAWSKeyFingerprint(pubKey)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unexpected type of SSH key\") {\n\t\treturn \"\", fmt.Errorf(\"generate an RSA or ed25519 key for AWS: %w\", err)\n\t}\n\treturn \"\", err\n}","preventionTips":["Generate keys with `ssh-keygen -t rsa` or `-t ed25519` for AWS use","Check first token of the pub key before importing","Use ComputeOpenSSHKeyFingerprint when algorithm support isn't restricted"],"tags":["ssh","aws","fingerprint","unsupported-algorithm"],"backgroundTag":"ssh-key-algorithm-unsupported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}