kubernetes/kops · error

error rendering SSHKey PublicKey: %v

Error message

error rendering SSHKey PublicKey: %v

What it means

In createKeypair (RenderAWS), when the task specifies PublicKey, kOps renders it to bytes to send as PublicKeyMaterial to ec2.ImportKeyPair. If rendering the resource fails, the error "error rendering SSHKey PublicKey" is returned before any AWS call. This is a local resource-materialization failure, distinct from AWS rejecting the key.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sshkey.go:162

			return fi.CannotChangeField("Name")
		}
	}
	return nil
}

func (e *SSHKey) createKeypair(cloud awsup.AWSCloud) error {
	ctx := context.TODO()
	klog.V(2).Infof("Creating SSHKey with Name:%q", *e.Name)

	request := &ec2.ImportKeyPairInput{
		KeyName:           e.Name,
		TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeKeyPair, e.Tags),
	}

	if e.PublicKey != nil {
		d, err := fi.ResourceAsBytes(e.PublicKey)
		if err != nil {
			return fmt.Errorf("error rendering SSHKey PublicKey: %v", err)
		}
		request.PublicKeyMaterial = d
	}

	response, err := cloud.EC2().ImportKeyPair(ctx, request)
	if err != nil {
		return fmt.Errorf("error creating SSHKey: %v", err)
	}

	e.KeyFingerprint = response.KeyFingerprint
	e.ID = response.KeyPairId

	return nil
}

func (_ *SSHKey) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SSHKey) error {
	if a == nil {
		return e.createKeypair(t.Cloud)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause and fix the underlying resource (path, permissions, resolution).
2. Ensure the public key file still exists and is readable when kops apply runs.
3. When using kOps programmatically, construct the resource with fi.NewStringResource or NewBytesResource with valid data.
4. Re-run the upstream step that generates the key before applying the SSHKey task.

Example fix

// before
e.PublicKey = fi.NewResource("/tmp/generated.pub") // file removed earlier in pipeline
// after
pub, err := os.ReadFile("/tmp/generated.pub")
if err != nil { return err }
e.PublicKey = fi.NewBytesResource(pub)

data, err := os.ReadFile(pubKeyPath)
if err != nil { return fmt.Errorf("public key %s unreadable before apply: %w", pubKeyPath, err) }
if len(bytes.TrimSpace(data)) == 0 { return fmt.Errorf("public key %s is empty", pubKeyPath) }

When it happens

Trigger: fi.ResourceAsBytes(e.PublicKey) errors: underlying resource (file/bytes/handler) unreadable or unresolved at render time — e.g. key content was supplied via a resource that depends on a failed earlier step.

Common situations: Pipeline where the public key was generated in a previous task that failed; file deleted between normalize and apply; programmatic use of kOps libraries with an incorrectly constructed resource.

Related errors

• error rendering SSHKey PublicKey: %v
• DIGITALOCEAN_ACCESS_TOKEN is required
• timed out waiting for volume to detach
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4adc311fe6fc5dec. Report an issue: GitHub.