kubernetes/kops · error

error parsing SSH public key: %v

Error message

error parsing SSH public key: %v

What it means

Fingerprint calls ssh.ParseAuthorizedKey on the admin SSH public key read from the state store; the key is not a valid OpenSSH authorized-key line (truncated, wrong format such as bare RFC4716 headers, or corrupt bytes), so no MD5 fingerprint can be computed.

Source

Thrown at pkg/sshcredentials/fingerprint.go:30

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package sshcredentials

import (
	"bytes"
	"crypto/md5"
	"fmt"

	"golang.org/x/crypto/ssh"
)

func Fingerprint(pubkey string) (string, error) {
	sshPublicKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubkey))
	if err != nil {
		return "", fmt.Errorf("error parsing SSH public key: %v", err)
	}

	// compute fingerprint to serve as id
	h := md5.New()
	_, err = h.Write(sshPublicKey.Marshal())
	if err != nil {
		return "", fmt.Errorf("error fingerprinting SSH public key: %v", err)
	}
	id := formatFingerprint(h.Sum(nil))
	return id, nil
}

func formatFingerprint(data []byte) string {
	var buf bytes.Buffer

	for i, b := range data {
		s := fmt.Sprintf("%0.2x", b)
		if i != 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-import a valid key: `kops create secret sshpublickey admin -i ~/.ssh/id_rsa.pub`
2. Ensure the key is a single-line OpenSSH public key (ssh-rsa/ssh-ed25519 ... comment), not a private key or multiline PEM
3. Delete the corrupt secret first with `kops delete secret sshpublickey admin` if replacing it

When it happens

Trigger: Thrown at pkg/sshcredentials/fingerprint.go:30 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/13503cd9b1cad083. Report an issue: GitHub.