Installer: Installation fails with SSH handshake problem

[tvieira]

Version

$ openshift-install version
openshift-install-4.2 unreleased-master-1745-g66e47aaae34c84618d3506ff133ea8c9df2ae8c9-dirty
built from commit 66e47aaae34c84618d3506ff133ea8c9df2ae8c9
release image registry.svc.ci.openshift.org/ocp/release@sha256:5ec723200f498e702b9494679d198fa0a0506724e943d517d7920be72921c914

Platform:

aws

What happened?

By running the create cluster command, and selecting the options manually, the installation fails as the SSH handshake fails.

$ openshift-install create cluster
? SSH Public Key /Users/tmoreira/.ssh/id_rsa.pub
? Platform aws
? Region us-east-1
? Base Domain devcluster.openshift.com
? Cluster Name tmoreira-08
? Pull Secret [? for help] ****************************
INFO Creating infrastructure resources...
INFO Waiting up to 30m0s for the Kubernetes API at https://api.tmoreira-08.devcluster.openshift.com:6443... 
INFO Pulling debug logs from the bootstrap machine 
ERROR Attempted to gather debug logs after installation failure: failed to create SSH client, ensure the proper ssh key is in your keyring or specify with --key: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain FATAL Bootstrap failed to complete: waiting for Kubernetes API: context deadline exceeded

What you expected to happen?

Installation succeeds.

How to reproduce it (as minimally and precisely as possible)?

1. Run

$ openshift-install create cluster

1. Make your selections manually (do not use config file)

Anything else we need to know?

I have 3 different public keys in my .ssh/ directory and I tried with all of them.

[tvieira]

I also tried selecting "none" for the SSH keys and got the same error.

[gbaufake]

I am facing the same issue on Mac OS X and Fedora 30

openshift-install version

built from commit 073ee39e7bb99e6bc09245a9a877ab6915251dc5
release image registry.svc.ci.openshift.org/ocp/release@sha256:ad180b3a7d1da51f6619146d31e9d85af712002303c6ddaef3f8fe82f666b090

[wking]

ERROR Attempted to gather debug logs after installation failure: failed to create SSH client, ensure the proper ssh key is in your keyring or specify with --key: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
FATAL Bootstrap failed to complete: waiting for Kubernetes API: context deadline exceeded

The primary error here is the Kubernetes API not coming up in time (the FATAL). We try to automatically gather logs to help explain why, and that is failing too (the ERROR).

I talked this over with @mattmahoneyrh out of band, and at least in his case the issue was SSH_AUTH_SOCK present in his installer environment. When that's set, we just use it instead of constructing our own agent.Agent with discovered SSH keys. That means you'll need to either unset SSH_AUTH_SOCK when calling openshift-install ... create cluster or openshift-install ... gather bootstrap ..., or add the relevant key to your existing agent with ssh-add ....

I'll try to land some logging and error wrapping to help make this process clearer when it goes wrong.

[tommyreilly]

Just a FYI that I was facing this same error when installing OSE 4.2 Preview on GCP from my Mac laptop and until I found this thread was getting very frustrated. Unsetting SSH_AUTH_SOCK worked for me.

[jralmaraz]

Tried unset SSH_AUTH_SOCK, tried adding key to ssh agent, nothing worked :(

openshift-install version
./bin/openshift-install unreleased-master-1130-g311a8a1266268aa454e45049e85f2b3c186715c7
built from commit 311a8a1266268aa454e45049e85f2b3c186715c7
release image registry.svc.ci.openshift.org/origin/release:4.2

Will try getting a newer version.

[jralmaraz]

Tried again with the unset and it worked, thanks!

[abhinavdahiya]

Tried again with the unset and it worked, thanks!

/close

[openshift-ci-robot]

@abhinavdahiya: Closing this issue.

In response to this:

Tried again with the unset and it worked, thanks!

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Nurlan199206]

@tommyreilly i have same error, where i can find it?

Unsetting SSH_AUTH_SOCK worked for me.

[Dennys503]

ERROR Attempted to gather debug logs after installation failure: failed to create SSH client, ensure the proper ssh key is in your keyring or specify with --key: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
FATAL Bootstrap failed to complete: waiting for Kubernetes API: context deadline exceeded

The primary error here is the Kubernetes API not coming up in time (the FATAL). We try to automatically gather logs to help explain why, and that is failing too (the ERROR).

I talked this over with @mattmahoneyrh out of band, and at least in his case the issue was SSH_AUTH_SOCK present in his installer environment. When that's set, we just use it instead of constructing our own agent.Agent with discovered SSH keys. That means you'll need to either unset SSH_AUTH_SOCK when calling openshift-install ... create cluster or openshift-install ... gather bootstrap ..., or add the relevant key to your existing agent with ssh-add ....

I'll try to land some logging and error wrapping to help make this process clearer when it goes wrong.

Can you help me solve my problem, I have the same error. Try unset SSH_AUTH_SOCK and then openhift-install wait-for bootstrap-complete --log-level debug. And the result is the same. FATAL failed to create SSH client, ensure the proper ssh key is in your keyring or specify with --key: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

[xenolinux]

how do we unset SSH_AUTH_SOCK in mac OS? would this work? export SSH_AUTH_SOCK="" and launchctl stop com.openssh.ssh-agent