kubernetes/kops · error

error rendering SSH key data: %w

Error message

error rendering SSH key data: %w

What it means

When Find() locates a matching SSH key in Linode, it renders the task's local PublicKey resource to a string to compare against the remote key. If reading/rendering the local resource fails (unreadable file, parse error), the error is wrapped with this message.

Source

Thrown at upup/pkg/fi/cloudup/linodetasks/sshkey.go:83

			return nil, fmt.Errorf("found multiple SSH keys named %q", name)
		}
		matched = key
	}

	if matched == nil {
		return nil, nil
	}

	actual := &SSHKey{
		ID:        new(matched.ID),
		Name:      new(matched.Label),
		Lifecycle: s.Lifecycle,
	}

	if s.PublicKey != nil {
		expectedPublicKey, err := fi.ResourceAsString(*s.PublicKey)
		if err != nil {
			return nil, fmt.Errorf("error rendering SSH key data: %w", err)
		}

		if strings.TrimSpace(expectedPublicKey) != strings.TrimSpace(matched.SSHKey) {
			return nil, fmt.Errorf("found SSH key %q in Akamai (Linode), but public key data did not match", name)
		}

		// Avoid spurious changes.
		actual.PublicKey = s.PublicKey
	}

	return actual, nil
}

func (e *SSHKey) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (_ *SSHKey) CheckChanges(actual, expected, changes *SSHKey) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the sshPublicKey / public key file path in the cluster spec exists and is readable on the machine running kops
2. Verify file permissions (e.g. chmod 644) for the key file
3. Inspect the wrapped inner error for the underlying read failure
4. Re-run kops update after fixing the key file

Example fix

// before
sshPublicKey: file:///home/user/.ssh/id_rsa_missing.pub
// after
sshPublicKey: file:///home/user/.ssh/id_rsa.pub

data, err := os.ReadFile(pubKeyPath)
if err != nil {
    return fmt.Errorf("cannot read public key %s: %w", pubKeyPath, err)
}
if _, _, _, _, err := ssh.ParseAuthorizedKey(data); err != nil {
    return fmt.Errorf("invalid public key: %w", err)
}

actual, err := task.Find(ctx)
if err != nil {
    if strings.Contains(err.Error(), "error rendering SSH key data") {
        // fix/re-read the local public key file, then retry
    }
    return err
}

When it happens

Trigger: s.PublicKey is non-nil and fi.ResourceAsString(*s.PublicKey) returns an error while Find() diffs the desired vs actual key.

Common situations: The SSH public key file path in the cluster spec doesn't exist or isn't readable on the machine running kops, or the resource is malformed.

Related errors

• found multiple SSH keys named %q
• found SSH key %q in Akamai (Linode), but public key data did
• error creating Akamai (Linode) SSH key %q: %w
• error parsing Akamai (Linode) %s ID %q: %w
• error listing Akamai (Linode) instances: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b291cd7f8cfb49ac. Report an issue: GitHub.