kubernetes/kops · error

error computing key fingerprint for SSH key: %v

Error message

error computing key fingerprint for SSH key: %v

What it means

During the Normalize phase of the OpenStack SSHKey task, kOps computes the OpenSSH fingerprint of the configured public key (via pki.ComputeOpenSSHKeyFingerprint) when no fingerprint has been set yet. This error wraps any failure from that computation, meaning the key material in e.PublicKey could not be read into a valid format or parsed as an SSH public key.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/sshkey.go:82

		klog.V(2).Infof("SSH key fingerprints match; assuming public keys match")
		actual.PublicKey = e.PublicKey
	} else {
		klog.V(2).Infof("Computed SSH key fingerprint mismatch: %q %q", fi.ValueOf(e.KeyFingerprint), fi.ValueOf(actual.KeyFingerprint))
	}
	actual.Lifecycle = e.Lifecycle
	return actual, nil
}

func (e *SSHKey) Normalize(c *fi.CloudupContext) error {
	if e.KeyFingerprint == nil && e.PublicKey != nil {
		publicKey, err := fi.ResourceAsString(e.PublicKey)
		if err != nil {
			return fmt.Errorf("error reading SSH public key: %v", err)
		}

		keyFingerprint, err := pki.ComputeOpenSSHKeyFingerprint(publicKey)
		if err != nil {
			return fmt.Errorf("error computing key fingerprint for SSH key: %v", err)
		}
		klog.V(2).Infof("Computed SSH key fingerprint as %q", keyFingerprint)
		e.KeyFingerprint = &keyFingerprint
	}
	return nil
}

func (e *SSHKey) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {
	if a == nil {
		if e.Name == nil {
			return fi.RequiredField("Name")
		}
	} else {
		if changes.Name != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the cluster spec's sshPublicKey points to a valid OpenSSH public key file (the .pub file, one line starting with ssh-rsa/ssh-ed25519/etc.); regenerate with `ssh-keygen -t ed25519` if in doubt.
2. Run `ssh-keygen -lf <file>` locally to confirm the file parses and has a fingerprint.
3. Ensure the file is readable and contains no HTML/error output (check you didn't download a 404 page as the key).
4. If the key is fine but still failing, update kOps — pki.ComputeOpenSSHKeyFingerprint has gained support for more key types over time.

Example fix

# before: pointing at the private key
sshPublicKey: file:///home/user/.ssh/id_ed25519
# after: pointing at the public key
sshPublicKey: file:///home/user/.ssh/id_ed25519.pub

// Before running kops, validate the key parses and has a fingerprint:
pub, err := os.ReadFile(pubKeyPath)
if err != nil { return fmt.Errorf("cannot read public key %s: %w", pubKeyPath, err) }
if _, _, _, _, err := ssh.ParseAuthorizedKey(bytes.TrimSpace(pub)); err != nil {
	return fmt.Errorf("%s is not a valid OpenSSH public key: %w", pubKeyPath, err)
}
_, err = pki.ComputeOpenSSHKeyFingerprint(string(pub))
if err != nil { return fmt.Errorf("fingerprint computation failed for %s: %w", pubKeyPath, err) }

func isOpenSSHPublicKey(s string) bool {
	_, _, _, _, err := ssh.ParseAuthorizedKey([]byte(strings.TrimSpace(s)))
	return err == nil && (strings.HasPrefix(s, "ssh-") || strings.HasPrefix(s, "ecdsa-"))
}

When it happens

Trigger: SSHKey task has KeyFingerprint == nil and PublicKey != nil, and either fi.ResourceAsString fails to render the key resource, or the rendered string is not a parseable OpenSSH-format public key (e.g. garbage, empty, PEM/private key, or unsupported format) so ComputeOpenSSHKeyFingerprint returns an error.

Common situations: Cluster config points at a keypair file that contains a private key or certificate instead of the .pub file; the ssh key path in the cluster spec is wrong so an empty/HTML error page is read; a key generated with a format unsupported by the parser (e.g. some RFC4716 or corrupted key); manually edited cluster yaml pasting a mangled single-line key.

Related errors

• error reading SSH public key: %v
• error rendering SSHKey PublicKey: %v
• error computing fingerprint for SSH public key: %v
• unexpected type of SSH key (%T); AWS can only import RSA and
• error marshaling SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/89b6c3d2ab44f13d. Report an issue: GitHub.