#1913·kamal

Config SSH key_data causing net-ssh issue with secrets from password manager

Author: redbassettCreated Jul 11, 2026Updated Jul 12, 2026

I'm running Kamal version 2.12.0 in a Rail project. I am managing my SSH keys in a secrets manager (1Password) rather than with local ssh key files. In my Kamal secrets, I have a SSH_PRIVATE_KEY secret defined and running kamal secrets print confirms this is set. In my deploy.yml I've told Kamal to use this private key:

yaml
# Use SSH key provided from secrets
ssh:
  key_data:
    - SSH_PRIVATE_KEY

When I try to deploy though, I get an SSH error indicating in incorrect key:

ERROR (NoMethodError): Exception while executing on host [IP ADDR]: undefined method 'public_key' for an instance of OpenSSL::PKey::PKey

SSH_PRIVATE_KEY is defined in my secrets as follows:

SSH_PRIVATE_KEY=$(kamal secrets extract "private key" ${SSH_SECRETS})

This results in the following formatting if I run kamal config:

:ssh_options:
  :key_data:
  - |-
    -----BEGIN PRIVATE KEY-----
    G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
    6CLxkjht9erQXTyw==
    -----END PRIVATE KEY-----

For whatever reason, the indentation formatting of this key is what is causing the error. To debug I copied the key into a string instead in my secrets file:

SSH_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
6CLxkjht9erQXTyw==
-----END PRIVATE KEY-----"

This also fails, HOWEVER, if I then introduce indentation as follows, it works fine:

:ssh_options:
  :key_data:
  - |-
    -----BEGIN PRIVATE KEY-----
     G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
     6CLxkjht9erQXTyw==
     -----END PRIVATE KEY-----

The issue seems to lie in how the key is passed to net-ssh, where for some reason having an extra ignored character (like a space or a dash) at the beginning of each line.

To demonstrate this even better, here is the temporary solution I have found to work around this where I use sed to prepend a dash to each line in the key:

SSH_PRIVATE_KEY=$((kamal secrets extract "private key" ${SSH_SECRETS}) | sed 's/^/-/')

:ssh_options:
  :key_data:
  - |-
    ------BEGIN PRIVATE KEY-----
    -G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
    -6CLxkjht9erQXTyw==
    ------END PRIVATE KEY-----