{"record":{"id":"dbe6c37f0e8d8eed","repo":"kubernetes/kops","slug":"error-rendering-sshkey-publickey-v-dbe6c3","errorCode":null,"errorMessage":"error rendering SSHKey PublicKey: %v","messagePattern":"error rendering SSHKey PublicKey: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/sshkey.go","lineNumber":127,"sourceCode":"\nfunc openstackKeyPairName(org string) string {\n\tname := strings.ReplaceAll(org, \".\", \"-\")\n\tname = strings.ReplaceAll(name, \":\", \"_\")\n\treturn name\n}\n\nfunc (_ *SSHKey) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SSHKey) error {\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating Keypair with name:%q\", fi.ValueOf(e.Name))\n\n\t\topt := keypairs.CreateOpts{\n\t\t\tName: openstackKeyPairName(fi.ValueOf(e.Name)),\n\t\t}\n\n\t\tif e.PublicKey != nil {\n\t\t\td, err := fi.ResourceAsString(e.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error rendering SSHKey PublicKey: %v\", err)\n\t\t\t}\n\t\t\topt.PublicKey = d\n\t\t}\n\n\t\tv, err := t.Cloud.CreateKeypair(opt)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error creating keypair: %v\", err)\n\t\t}\n\n\t\te.KeyFingerprint = new(v.Fingerprint)\n\t\tklog.V(2).Infof(\"Creating a new Openstack keypair, id=%s\", v.Fingerprint)\n\t\treturn nil\n\t}\n\te.KeyFingerprint = a.KeyFingerprint\n\tklog.V(2).Infof(\"Using an existing Openstack keypair, id=%s\", fi.ValueOf(e.KeyFingerprint))\n\treturn nil\n}\n","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/sshkey.go#L109-L145","documentation":"In RenderOpenstack, when creating a new OpenStack keypair, kOps converts the SSHKey task's PublicKey resource to a string with fi.ResourceAsString before passing it to the Nova keypair-create API. This error means the PublicKey resource could not be rendered to a string (read failure of the underlying resource), so the keypair cannot be created.","triggerScenarios":"RenderOpenstack runs with a == nil (keypair does not exist in OpenStack yet) and e.PublicKey != nil, but fi.ResourceAsString(e.PublicKey) returns an error — the resource backing the public key cannot be read/serialized at render time.","commonSituations":"The file/resource referenced as the public key disappeared between cluster spec parsing and apply (path moved, container FS changed); a custom fi.Resource implementation (e.g. memfs resource in tests or a URL-declared resource) fails to open; network/permission failure reading a remote resource.","solutions":["Confirm the file or resource referenced by sshPublicKey still exists and is readable at apply time.","If using a URL-based resource, check it is fetchable (no auth walls, correct scheme).","Retry `kops update cluster` — transient read failures resolve on re-run.","If the resource is custom (embedded/test), verify its Open()/AsString implementation returns valid key bytes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure the key resource resolves to a non-empty string before apply:\nd, err := fi.ResourceAsString(publicKeyResource)\nif err != nil {\n\treturn fmt.Errorf(\"public key resource unreadable: %w\", err)\n}\nif strings.TrimSpace(d) == \"\" {\n\treturn fmt.Errorf(\"public key resource is empty; check the sshPublicKey file/URL\")\n}\nif !isOpenSSHPublicKey(d) {\n\treturn fmt.Errorf(\"public key content is not a valid OpenSSH public key\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the key file/URL is stable and readable on the machine running kops.","Avoid remote URL key sources that can 404 or require auth at apply time.","Run `kops update cluster` with the same user/FS context you validated the key with.","Wrap custom fi.Resource implementations with tests asserting AsString succeeds."],"tags":["openstack","ssh","keypair","resource-render"],"backgroundTag":"ssh-key-parse-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}