Description of problem: While trying to import public key of type 'ed25519' in nova, the import fails with exception "Keypair data is invalid". ---Actual error logs--- 2019-01-22 12:06:13.164 15 INFO nova.api.openstack.wsgi [req-5fadb4f9-565f-41a7-a1f3-8e4a49af8046 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint 2019-01-22 12:12:08.656 14 INFO nova.api.openstack.wsgi [req-a6aecfd6-bf36-48cb-ad71-d5fa786d9ba1 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint 2019-01-22 12:13:17.715 14 INFO nova.api.openstack.wsgi [req-bc3c2dfc-0f9e-4e83-a67d-3ebb86c8b7ca 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint 2019-01-22 12:13:41.072 14 INFO nova.api.openstack.wsgi [req-bdb362ee-72f0-43a4-894c-23d52dcbe165 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint 2019-01-22 12:14:10.933 15 INFO nova.api.openstack.wsgi [req-c6d182b8-36d2-4c3b-93d2-2a060af4a61a 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint 2019-01-22 12:18:31.012 14 INFO nova.api.openstack.wsgi [req-3c901055-1a8f-4cf5-9d97-9ad0514c773b 3dade9ba54ee47c2bb4012e24d84fe09 d8ac454e969c45b788d96d3445adafe4 - default default] HTTP exception thrown: Keypair data is invalid: failed to generate fingerprint --------------- Version-Release number of selected component (if applicable): How reproducible: Try importing the the public key into nova with a ssh key type of 'ed25519' architecture and not rsa/ecdsa. Steps to Reproduce: 1. 2. 3. Actual results: Keypair data is invalid: failed to generate fingerprint Expected results: Keypair should have been created, with the specified public key import. Additional info:
This has been reported upstream as well, for some time: https://bugs.launchpad.net/nova/+bug/1555521 but support for ed25519 keys needs to be added to the upstream python cryptography package first before we can consume it in nova. The pull request tracking that work is located here: https://github.com/pyca/cryptography/pull/4114 Once support is available in the cryptography package, we should be able to use the keys in nova.
git hub pull request not yet merged 2019-02-22
The github pull request has merged and version 2.6 of python-cryptography has been released today. The changelog states that support for ed25519 keys is now available when using OpenSSL 1.1.1b or newer: https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
According to our records, this should be resolved by openstack-nova-20.6.2-2.20210607104828.el8ost.4. This build is available now.