kubernetes/kops · error

error rendering SSHKey PublicKey: %v

Error message

error rendering SSHKey PublicKey: %v

What it means

In RenderOpenstack, when creating a new OpenStack keypair, kOps converts the SSHKey task's PublicKey resource to a string with fi.ResourceAsString before passing it to the Nova keypair-create API. This error means the PublicKey resource could not be rendered to a string (read failure of the underlying resource), so the keypair cannot be created.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/sshkey.go:127

func openstackKeyPairName(org string) string {
	name := strings.ReplaceAll(org, ".", "-")
	name = strings.ReplaceAll(name, ":", "_")
	return name
}

func (_ *SSHKey) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SSHKey) error {
	if a == nil {
		klog.V(2).Infof("Creating Keypair with name:%q", fi.ValueOf(e.Name))

		opt := keypairs.CreateOpts{
			Name: openstackKeyPairName(fi.ValueOf(e.Name)),
		}

		if e.PublicKey != nil {
			d, err := fi.ResourceAsString(e.PublicKey)
			if err != nil {
				return fmt.Errorf("error rendering SSHKey PublicKey: %v", err)
			}
			opt.PublicKey = d
		}

		v, err := t.Cloud.CreateKeypair(opt)
		if err != nil {
			return fmt.Errorf("Error creating keypair: %v", err)
		}

		e.KeyFingerprint = new(v.Fingerprint)
		klog.V(2).Infof("Creating a new Openstack keypair, id=%s", v.Fingerprint)
		return nil
	}
	e.KeyFingerprint = a.KeyFingerprint
	klog.V(2).Infof("Using an existing Openstack keypair, id=%s", fi.ValueOf(e.KeyFingerprint))
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the file or resource referenced by sshPublicKey still exists and is readable at apply time.
2. If using a URL-based resource, check it is fetchable (no auth walls, correct scheme).
3. Retry `kops update cluster` — transient read failures resolve on re-run.
4. If the resource is custom (embedded/test), verify its Open()/AsString implementation returns valid key bytes.

// Ensure the key resource resolves to a non-empty string before apply:
d, err := fi.ResourceAsString(publicKeyResource)
if err != nil {
	return fmt.Errorf("public key resource unreadable: %w", err)
}
if strings.TrimSpace(d) == "" {
	return fmt.Errorf("public key resource is empty; check the sshPublicKey file/URL")
}
if !isOpenSSHPublicKey(d) {
	return fmt.Errorf("public key content is not a valid OpenSSH public key")
}

When it happens

Trigger: RenderOpenstack runs with a == nil (keypair does not exist in OpenStack yet) and e.PublicKey != nil, but fi.ResourceAsString(e.PublicKey) returns an error — the resource backing the public key cannot be read/serialized at render time.

Common situations: The file/resource referenced as the public key disappeared between cluster spec parsing and apply (path moved, container FS changed); a custom fi.Resource implementation (e.g. memfs resource in tests or a URL-declared resource) fails to open; network/permission failure reading a remote resource.

Related errors

• error reading SSH public key: %v
• error computing key fingerprint for SSH key: %v
• exactly one 'admin' SSH public key can be specified when run
• error rendering SSHKey PublicKey: %v
• error listing keypair: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/dbe6c37f0e8d8eed. Report an issue: GitHub.