kubernetes/kops · error

error parsing SSH public key: %q

Error message

error parsing SSH public key: %q

What it means

parseSSHPublicKey splits the public key string on whitespace and requires at least two fields: the key type (e.g. 'ssh-rsa') and the base64 blob. Fewer than two fields means the string is not a valid single-line SSH public key. Callers ComputeAWSKeyFingerprint and ComputeOpenSSHKeyFingerprint pass user-supplied key material here.

Source

Thrown at pkg/pki/sshkey.go:37

import (
	"bytes"
	"crypto"
	"crypto/md5"
	"crypto/rsa"
	"crypto/x509"
	"encoding/base64"
	"fmt"
	"reflect"
	"strings"

	"golang.org/x/crypto/ssh"
)

// parseSSHPublicKey parses the SSH public key string
func parseSSHPublicKey(publicKey string) (ssh.PublicKey, error) {
	tokens := strings.Fields(publicKey)
	if len(tokens) < 2 {
		return nil, fmt.Errorf("error parsing SSH public key: %q", publicKey)
	}

	sshPublicKeyBytes, err := base64.StdEncoding.DecodeString(tokens[1])
	if err != nil {
		return nil, fmt.Errorf("error decoding SSH public key: %q err: %s", publicKey, err)
	}
	if len(tokens) < 2 {
		return nil, fmt.Errorf("error decoding SSH public key: %q", publicKey)
	}

	sshPublicKey, err := ssh.ParsePublicKey(sshPublicKeyBytes)
	if err != nil {
		return nil, fmt.Errorf("error parsing SSH public key: %v", err)
	}
	return sshPublicKey, nil
}

// colonSeparatedHex formats the byte slice SSH-fingerprint style: hex bytes separated by colons

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm you are passing the .pub public key file contents, e.g. `kops create secret sshpublickey admin -i ~/.ssh/id_rsa.pub`
2. Ensure the string starts with the key type token ('ssh-rsa', 'ssh-ed25519', etc.) followed by the base64 blob on one line
3. Check that the key wasn't truncated or whitespace-stripped when stored/passed

Example fix

// before
fp, err := pki.ComputeAWSKeyFingerprint(string(privKeyBytes))
// after
fp, err := pki.ComputeAWSKeyFingerprint(string(pubKeyBytes)) // contents of id_rsa.pub

func looksLikeSSHPubKey(s string) bool {
	f := strings.Fields(s)
	return len(f) >= 2 && strings.HasPrefix(f[0], "ssh-")
}
if !looksLikeSSHPubKey(pubKey) {
	return fmt.Errorf("not an OpenSSH public key line (type + base64 blob expected)")
}
fp, err := pki.ComputeAWSKeyFingerprint(pubKey)

func isSSHKeyType(token string) bool {
	switch token {
	case "ssh-rsa", "ssh-ed25519", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521":
		return true
	}
	return false
}

fp, err := pki.ComputeAWSKeyFingerprint(pubKey)
if err != nil {
	return fmt.Errorf("invalid SSH public key supplied: %w", err)
}

When it happens

Trigger: Passing an empty string, a passphrase only, a multi-line file's first line being blank, or passing an OpenSSH PRIVATE key block ('-----BEGIN OPENSSH PRIVATE KEY-----') whose first whitespace-delimited token set doesn't include a type+blob pair.

Common situations: Users pasting `cat id_rsa` (private key) instead of `id_rsa.pub`, or an empty key field in cluster spec / AWS metadata after a failed kops create secret sshpublickey.

Related errors

• spec.PublicKey is required
• error adding SSH public key: %v
• parsing private key %q: %v
• host is required
• hostname was empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c06f991c2b1d3d9c. Report an issue: GitHub.