What causes "error fingerprinting SSH public key: %v" in kubernetes/kops?

Retry the operation; this is a transient/unexpected internal failure

error fingerprinting SSH public key: %v

Error message

error fingerprinting SSH public key: %v

What it means

FingerprintSSHKey computes an identifier for an SSH public key by marshaling the key and hashing it with MD5; the hex digest becomes the key's id. This error wraps any failure returned by the hash writer itself. In practice hash.Write never fails, so this is effectively an unreachable defensive branch.

Source

Thrown at pkg/sshcredentials/fingerprint.go:37

import (
	"bytes"
	"crypto/md5"
	"fmt"

	"golang.org/x/crypto/ssh"
)

func Fingerprint(pubkey string) (string, error) {
	sshPublicKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubkey))
	if err != nil {
		return "", fmt.Errorf("error parsing SSH public key: %v", err)
	}

	// compute fingerprint to serve as id
	h := md5.New()
	_, err = h.Write(sshPublicKey.Marshal())
	if err != nil {
		return "", fmt.Errorf("error fingerprinting SSH public key: %v", err)
	}
	id := formatFingerprint(h.Sum(nil))
	return id, nil
}

func formatFingerprint(data []byte) string {
	var buf bytes.Buffer

	for i, b := range data {
		s := fmt.Sprintf("%0.2x", b)
		if i != 0 {
			buf.WriteString(":")
		}
		buf.WriteString(s)
	}
	return buf.String()
}

View on GitHub (pinned to 4c8573c808)

Solutions

Retry the operation; this is a transient/unexpected internal failure
Verify the SSH public key file parses correctly (ssh-keygen -lf <file>) since upstream parse failures are the usual real cause of problems in this path
If reproducible, file a bug with the key format and kOps version

Example fix

// before
pubkey, err := os.ReadFile("id_rsa") // binary/private key by mistake
id, err := FingerprintSSHKey(pubkey)
// after
pubkey, err := os.ReadFile("id_rsa.pub") // use the .pub public key file
id, err := FingerprintSSHKey(pubkey)

Defensive patterns

Strategy: try-catch

Validate before calling

// Go: verify the key is a parseable SSH public key before fingerprinting
_, _, _, _, err := ssh.ParseAuthorizedKey(pubkeyBytes)
if err != nil {
	return fmt.Errorf("not a valid SSH public key: %w", err)
}

Type guard

func isSSHAuthorizedKey(b []byte) bool {
	_, _, _, _, err := ssh.ParseAuthorizedKey(b)
	return err == nil
}

Try / catch

id, err := sshcredentials.FingerprintSSHKey(pubkey)
if err != nil {
	return fmt.Errorf("fingerprinting ssh public key: %w", err) // retry once on transient failure
}

Prevention

Always pass the contents of the .pub file, never the private key
Pre-validate keys with `ssh-keygen -lf` or golang.org/x/crypto/ssh before submitting
Treat this error as unexpected and log full context for a bug report

When it happens

Trigger: Calling FingerprintSSHKey (via kops get sshpublickeys, mirroring SSH credentials, or kops create sshpublickey) when h.Write on the md5 hash of sshPublicKey.Marshal() returns a non-nil error.

Common situations: Practically never seen in the field; it can only appear if the crypto/hash writer is somehow broken (memory/hash state corruption). More commonly the surrounding code fails for a bad key file or unparseable key, which produces a different error.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f1a5a6ce5bf1e24. Report an issue: GitHub.