{"record":{"id":"03a3a5ff8290f30a","repo":"kubernetes/kops","slug":"exactly-one-admin-ssh-public-key-can-be-specifie-03a3a5","errorCode":null,"errorMessage":"exactly one 'admin' SSH public key can be specified when running with Openstack; please delete a key using `kops delete secret`","messagePattern":"exactly one 'admin' SSH public key can be specified when running with Openstack; please delete a key using `kops delete secret`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":481,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"azure support is currently alpha, and is feature-gated. Please export KOPS_FEATURE_FLAGS=Azure\")\n\t\t\t}\n\n\t\t\tif len(sshPublicKeys) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"SSH public key must be specified when running with AzureCloud (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)\", cluster.ObjectMeta.Name)\n\t\t\t}\n\n\t\t\tif len(sshPublicKeys) != 1 {\n\t\t\t\treturn nil, fmt.Errorf(\"exactly one 'admin' SSH public key can be specified when running with AzureCloud; please delete a key using `kops delete secret`\")\n\t\t\t}\n\t\t}\n\tcase kops.CloudProviderOpenstack:\n\t\t{\n\t\t\tif len(sshPublicKeys) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"SSH public key must be specified when running with Openstack (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)\", cluster.ObjectMeta.Name)\n\t\t\t}\n\n\t\t\tif len(sshPublicKeys) != 1 {\n\t\t\t\treturn nil, fmt.Errorf(\"exactly one 'admin' SSH public key can be specified when running with Openstack; please delete a key using `kops delete secret`\")\n\t\t\t}\n\t\t}\n\n\tcase kops.CloudProviderScaleway:\n\t\t{\n\t\t\tif !featureflag.Scaleway.Enabled() {\n\t\t\t\treturn nil, fmt.Errorf(\"Scaleway support is currently alpha, and is feature-gated.  export KOPS_FEATURE_FLAGS=Scaleway\")\n\t\t\t}\n\n\t\t\tif len(sshPublicKeys) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"SSH public key must be specified when running with Scaleway (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)\", cluster.ObjectMeta.Name)\n\t\t\t}\n\t\t\tif len(sshPublicKeys) != 1 {\n\t\t\t\treturn nil, fmt.Errorf(\"exactly one 'admin' SSH public key can be specified when running with Scaleway; please delete a key using `kops delete secret`\")\n\t\t\t}\n\n\t\t\tscwCloud := cloud.(scaleway.ScwCloud)\n\t\t\tscwZone = scwCloud.Zone()","sourceCodeStart":463,"sourceCodeEnd":499,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L463-L499","documentation":"kOps's cluster apply (upup/pkg/fi/cloudup/apply_cluster.go, Run) requires that OpenStack clusters have exactly one SSH public key secret named 'admin'. The sshPublicKeys map (loaded from cluster secrets) must contain one entry; zero keys or more than one key both abort the apply. This exists because the OpenStack provisioning path injects a single admin keypair into instances and cannot disambiguate multiple keys.","triggerScenarios":"Running `kops update cluster` (via RunUpdateCluster/Run) for a cluster with cloudProvider=openstack while the 'sshpublickey' secret store holds zero entries or 2+ entries (e.g. multiple named keys).","commonSituations":"Users created several SSH key secrets over time (e.g. re-adding 'admin' plus a personal key) or imported keys from an old cluster; also fresh clusters where the key was never created.","solutions":["Ensure exactly one key exists: delete extra keys with `kops delete secret sshpublickey <name> --name <cluster>` then `kops update cluster` again","If no key exists, add one: `kops create secret --name <cluster> sshpublickey admin -i ~/.ssh/id_rsa.pub`","List current keys with `kops get secrets --type secret` to see which entries to remove"],"exampleFix":"// before: two sshpublickey secrets (admin, extra)\nkops delete secret sshpublickey extra --name mycluster.example.com\n// after: only 'admin' remains; kops update cluster succeeds","handlingStrategy":"validation","validationCode":"keys=$(kops get secrets --type secret -o name | grep sshpublickey | wc -l); [ \"$keys\" -eq 1 ] || echo \"need exactly 1 sshpublickey, found $keys\"","typeGuard":null,"tryCatchPattern":"if err := kops.UpdateCluster(ctx, cluster); err != nil { if strings.Contains(err.Error(), \"exactly one 'admin' SSH public key\") { /* reconcile secrets then retry */ } return err }","preventionTips":["Keep only the single 'admin' sshpublickey secret per openstack cluster","Audit secrets with `kops get secrets` before `kops update cluster`","Automate key creation in bootstrap scripts: create secret if absent, never add extra names"],"tags":["openstack","ssh","configuration","precondition"],"backgroundTag":"invalid-ssh-key-configuration","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}