{"record":{"id":"0e2d9e7a64be1e02","repo":"kubernetes/kops","slug":"ssh-public-key-must-be-specified-when-running-with","errorCode":null,"errorMessage":"SSH public key must be specified when running with DigitalOcean (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)","messagePattern":"SSH public key must be specified when running with DigitalOcean \\(create with `kops create secret --name (.+?) sshpublickey admin -i ~/\\.ssh/id_rsa\\.pub`\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":441,"sourceCode":"\t\tAdditionalObjects: c.AdditionalObjects,\n\t}\n\n\tswitch cluster.GetCloudProvider() {\n\tcase kops.CloudProviderGCE:\n\t\t{\n\t\t\tgceCloud := cloud.(gce.GCECloud)\n\t\t\tproject = gceCloud.Project()\n\t\t}\n\n\tcase kops.CloudProviderHetzner:\n\t\t{\n\t\t\t// Hetzner Cloud support is currently in beta\n\t\t}\n\n\tcase kops.CloudProviderDO:\n\t\t{\n\t\t\tif len(sshPublicKeys) == 0 && (c.Cluster.Spec.SSHKeyName == nil || *c.Cluster.Spec.SSHKeyName == \"\") {\n\t\t\t\treturn nil, fmt.Errorf(\"SSH public key must be specified when running with DigitalOcean (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)\", cluster.ObjectMeta.Name)\n\t\t\t}\n\t\t}\n\tcase kops.CloudProviderAWS:\n\t\t{\n\t\t\tawsCloud := cloud.(awsup.AWSCloud)\n\n\t\t\taccountID, partition, err := awsCloud.AccountInfo(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tmodelContext.AWSAccountID = accountID\n\t\t\tmodelContext.AWSPartition = partition\n\n\t\t\tif len(sshPublicKeys) > 1 {\n\t\t\t\treturn nil, fmt.Errorf(\"exactly one 'admin' SSH public key can be specified when running with AWS; please delete a key using `kops delete secret`\")\n\t\t\t}\n\t\t}\n","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L423-L459","documentation":"On DigitalOcean the SSH key must be uploaded to the provider before droplets can be created, so kOps requires at least one admin sshpublickey secret (or an explicit spec.sshKeyName) when building the DO cluster model; neither was present.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/apply_cluster.go:441 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create the admin key secret: `kops create secret --name <cluster> sshpublickey admin -i ~/.ssh/id_rsa.pub`","Alternatively set spec.sshKeyName to an SSH key already registered in DigitalOcean"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}