kubernetes/kops · error

error rendering SSH key data: %w

Error message

error rendering SSH key data: %w

What it means

resolveAuthorizedKeys turns the task's SSHKey resources into key strings. When a key carries its public key as an inline resource, it renders the resource to a string; this wraps any rendering failure.

Source

Thrown at upup/pkg/fi/cloudup/linodetasks/instance.go:274

	truncatedHash := fullHashString[:maxLength]

	return truncatedHash
}

// resolveAuthorizedKeys resolves the authorized keys for the instance.
// It checks if the key has a public key directly provided or if it needs to be looked up by name in Akamai (Linode).
func resolveAuthorizedKeys(client linode.LinodeClient, keys []*SSHKey) ([]string, error) {
	var authorizedKeys []string
	var keysByName map[string]string

	for _, key := range keys {
		if key == nil {
			continue
		}
		if key.PublicKey != nil {
			publicKey, err := fi.ResourceAsString(*key.PublicKey)
			if err != nil {
				return nil, fmt.Errorf("error rendering SSH key data: %w", err)
			}
			authorizedKeys = append(authorizedKeys, strings.TrimSpace(publicKey))
			continue
		}

		if keysByName == nil {
			listedKeys, err := client.ListSSHKeys(context.TODO(), nil)
			if err != nil {
				return nil, fmt.Errorf("error listing Akamai (Linode) SSH keys: %w", err)
			}
			keysByName = make(map[string]string, len(listedKeys))
			for _, listedKey := range listedKeys {
				keysByName[listedKey.Label] = listedKey.SSHKey
			}
		}

		publicKey, found := keysByName[fi.ValueOf(key.Name)]
		if !found {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check that the file backing the PublicKey resource exists and is readable
2. Verify the authorized_keys entries in the cluster spec use correct paths or inline content
3. Re-run after fixing the key source

Example fix

// before
authorizedKeys:
  - path: /nonexistent/id_ed25519.pub
// after
authorizedKeys:
  - path: ~/.ssh/id_ed25519.pub

// before apply, ensure each authorized key file is readable
for _, p := range keyPaths {
    if _, err := os.ReadFile(p); err != nil { return fmt.Errorf("ssh key %s unreadable: %w", p, err) }
}

When it happens

Trigger: fi.ResourceAsString fails on key.PublicKey — typically when the resource references a file that cannot be read or is otherwise unresolvable at render time.

Common situations: AuthorizedKeys entries pointing to a local file path that doesn't exist on the machine running kops, or an unreadable/empty key file.

Related errors

• error building Akamai (Linode) SSH key task: %w
• error listing Akamai (Linode) SSH keys: %w
• SSH key %q not found in Akamai (Linode)
• SSHKey.Name is required
• error listing Akamai (Linode) SSH keys: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/30b09da8766b305f. Report an issue: GitHub.