kubernetes/kops · error

error fingerprinting SSH public key %q: %v

Error message

error fingerprinting SSH public key %q: %v

What it means

mirrorSSHCredential fingerprints the SSH public key stored in an SSHCredential using sshcredentials.Fingerprint before writing it to the mirror path. If the stored PublicKey material is empty, malformed, or in an unsupported format, fingerprinting fails and this error wraps the reason along with the credential name.

Source

Thrown at upup/pkg/fi/vfs_castore.go:241

	}

	return nil
}

// mirrorKeyset writes Keyset bundles for the certificates & privatekeys.
func mirrorKeyset(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, name string, keyset *Keyset) error {
	if err := writeKeysetBundle(ctx, cluster, basedir.Join("private"), name, keyset); err != nil {
		return fmt.Errorf("writing private bundle: %v", err)
	}

	return nil
}

// mirrorSSHCredential writes the SSH credential file to the mirror location
func mirrorSSHCredential(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, sshCredential *kops.SSHCredential) error {
	id, err := sshcredentials.Fingerprint(sshCredential.Spec.PublicKey)
	if err != nil {
		return fmt.Errorf("error fingerprinting SSH public key %q: %v", sshCredential.Name, err)
	}

	p := basedir.Join("ssh", "public", sshCredential.Name, id)
	acl, err := acls.GetACL(ctx, p, cluster)
	if err != nil {
		return err
	}

	err = p.WriteFile(ctx, bytes.NewReader([]byte(sshCredential.Spec.PublicKey)), acl)
	if err != nil {
		return fmt.Errorf("error writing %q: %v", p, err)
	}

	return nil
}

func (c *VFSCAStore) StoreKeyset(ctx context.Context, name string, keyset *Keyset) error {
	if keyset.Primary == nil || keyset.Primary.Id == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the named SSHCredential's public key file in the state store for truncation/corruption and re-upload with `kops create sshpublickey`.
2. Ensure the key is in OpenSSH authorized_keys format (ssh-rsa AAAA... or ecdsa-sha2-...).
3. Remove or replace the malformed credential, then re-run the mirror.
4. Validate the key locally with `ssh-keygen -lf <keyfile>` before uploading to kops.

Example fix

// before (corrupted/truncated key in state store)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQ...[truncat
// after: re-upload a complete key
kops create sshpublickey admin -i ~/.ssh/id_rsa.pub --name mycluster

func validPublicKeyMaterial(pub string) error {
	if strings.TrimSpace(pub) == "" {
		return fmt.Errorf("empty public key")
	}
	if _, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pub)); err != nil {
		return fmt.Errorf("not a valid authorized_keys entry: %w", err)
	}
	return nil
}

if err := mirrorSSHCredential(ctx, cluster, basedir, cred); err != nil {
	if strings.Contains(err.Error(), "fingerprinting") {
		log.Printf("skipping corrupt SSH credential %q; re-upload with kops create sshpublickey", cred.Name)
		return nil // or abort, depending on policy
	}
	return err
}

When it happens

Trigger: MirrorTo -> mirrorSSHCredential when a stored SSHCredential's Spec.PublicKey cannot be parsed/fingerprinted: empty key bytes, truncated key file, wrong key format (not an authorized_keys-style OpenSSH/SSH2 key), or encoding corruption.

Common situations: SSH public keys uploaded with unsupported formats or line-wrapping corruption; state store files truncated by failed uploads; credentials created by very old kops versions with legacy formats.

Related errors

• error computing fingerprint for SSH public key: %v
• unexpected type of SSH key (%T); AWS can only import RSA and
• error marshaling SSH public key: %v
• error fingerprinting SSH public key: %v
• error listing SSHCredentials: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a788466f427f0f19. Report an issue: GitHub.