kubernetes/kops · error

error computing key fingerprint for SSH key: %v

Error message

error computing key fingerprint for SSH key: %v

What it means

After reading the public key material, Normalize computes the AWS-style MD5 fingerprint via pki.ComputeAWSKeyFingerprint. Failure is wrapped as "error computing key fingerprint for SSH key". This indicates the key material is malformed or in an unsupported format.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sshkey.go:128

	}

	e.ID = actual.ID
	if e.IsExistingKey() && *e.Name != "" {
		e.KeyFingerprint = actual.KeyFingerprint
	}
	return actual, nil
}

func (e *SSHKey) Normalize(c *fi.CloudupContext) error {
	if e.KeyFingerprint == nil && e.PublicKey != nil {
		publicKey, err := fi.ResourceAsString(e.PublicKey)
		if err != nil {
			return fmt.Errorf("error reading SSH public key: %v", err)
		}

		keyFingerprint, err := pki.ComputeAWSKeyFingerprint(publicKey)
		if err != nil {
			return fmt.Errorf("error computing key fingerprint for SSH key: %v", err)
		}
		klog.V(2).Infof("Computed SSH key fingerprint as %q", keyFingerprint)
		e.KeyFingerprint = &keyFingerprint
	}

	return nil
}

func (e *SSHKey) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {
	if a != nil {
		if changes.Name != nil {
			return fi.CannotChangeField("Name")
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass the public key file (id_rsa.pub), not the private key.
2. Regenerate or re-export the key in OpenSSH format: ssh-keygen -y -f id_rsa > id_rsa.pub.
3. Check the file for corruption/CRLF issues and re-save.
4. Use a supported algorithm (rsa, ed25519) accepted by EC2 import.

Example fix

// before
--ssh-public-key=~/.ssh/id_rsa      # private key
// after
--ssh-public-key=~/.ssh/id_rsa.pub  # public key

data, err := os.ReadFile(pubKeyPath)
if err != nil { return err }
out, err := exec.Command("ssh-keygen", "-l", "-f", pubKeyPath).Output()
if err != nil {
    return fmt.Errorf("key %s is not a valid public key: %v", pubKeyPath, err)
}

func isPublicKeyMaterial(data []byte) bool {
    return bytes.HasPrefix(data, []byte("ssh-rsa ")) ||
        bytes.HasPrefix(data, []byte("ssh-ed25519 ")) ||
        bytes.HasPrefix(data, []byte("ecdsa-sha2-"))
}

When it happens

Trigger: pki.ComputeAWSKeyFingerprint receives data that isn't a parseable SSH public key (e.g. a private key file, garbage bytes, or an unsupported format like a PEM-only blob).

Common situations: User passed a private key instead of a .pub file; key file contains Windows line endings with garbage; unsupported key algorithm/legacy format; truncated file.

Related errors

• error parsing SSH public key: %v
• spec.PublicKey is required
• error adding SSH public key: %v
• host is required
• hostname was empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf6b5972ae42a84f. Report an issue: GitHub.