I have a google compute engine instance with the default service account in the form of <project-number>-compute@developer.gserviceaccount.com. I can connect via SSH to my compute instance using my own pair of generated SSH keys. I followed this guide where I use a slightly modified version of the service_account_ssh.py script.
This works as expected. With the line oslogin.users().importSshPublicKey(parent=account, body=body).execute() from the script I could add my public key. This enables me to simply SSH into the compute instance like so:
ssh -i <private-key> <user>@<compute-instance-ip>
Note that I do not use an expire time for the SSH key and neither delete them after generation as the example script does.
However, I am unable to delete the public key from the service account. According to the OS Login API, there is a users.sshPublicKeys.delete method, but I can't get it to work.
The first problem I ran into is that I cannot find the Python reference OS Login API. With the service_account_ssh.py script as example, and the OS Login API, I was able to derive the Python method: oslogin.users().sshPublicKeys().delete(name=key).execute()
But now I'm stuck on the name field. According to the docs the name parameter should be the fingerprint of the public key in the format users/{user}/sshPublicKeys/{fingerprint}
No matter what I try, I get the Python error:
TypeError: Parameter "name" value "users/<project-number>-compute@developer.gserviceaccount.com/sshPublicKeys/<key-fingerprint>" does not match the pattern "^users/[^/]+/sshPublicKeys/[^/]+$". For security reasons I removed my actual values and replaced them with <project-number> and <key-fingerprint>
I generate my key fingerprint with ssh-keygen -lf <key>.pub, which outputs something in the form of SHA256:sadlkf43jqweIFND123oifja/sdflk3234j
Since I'm not that good with regex I used https://regexr.com/ to test my string against ^users/[^/]+/sshPublicKeys/[^/]+$. It appears the regex does not match on the key fingerprint because there is a forward slash / in the fingerprint of my key. If I remove this / the regex matches and my python script does not throw an error, however, now the key fingerprint is invalid.
I did a quick check with a bunch of other SSH keys and they all have a forward slash somewhere in their fingerprint. But now I don't understand how I can possibly call the API with the correct string. This is the exact point where I'm stuck and I hope someone can help me.
My question is: How can I delete (or get) my SSH key in Python using the OS Login API?