{"record":{"id":"605a02177a71b8ac","repo":"kubernetes/kops","slug":"error-creating-keypair-v-605a02","errorCode":null,"errorMessage":"Error creating keypair: %v","messagePattern":"Error creating keypair: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/sshkey.go","lineNumber":134,"sourceCode":"func (_ *SSHKey) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SSHKey) error {\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating Keypair with name:%q\", fi.ValueOf(e.Name))\n\n\t\topt := keypairs.CreateOpts{\n\t\t\tName: openstackKeyPairName(fi.ValueOf(e.Name)),\n\t\t}\n\n\t\tif e.PublicKey != nil {\n\t\t\td, err := fi.ResourceAsString(e.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error rendering SSHKey PublicKey: %v\", err)\n\t\t\t}\n\t\t\topt.PublicKey = d\n\t\t}\n\n\t\tv, err := t.Cloud.CreateKeypair(opt)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error creating keypair: %v\", err)\n\t\t}\n\n\t\te.KeyFingerprint = new(v.Fingerprint)\n\t\tklog.V(2).Infof(\"Creating a new Openstack keypair, id=%s\", v.Fingerprint)\n\t\treturn nil\n\t}\n\te.KeyFingerprint = a.KeyFingerprint\n\tklog.V(2).Infof(\"Using an existing Openstack keypair, id=%s\", fi.ValueOf(e.KeyFingerprint))\n\treturn nil\n}\n","sourceCodeStart":116,"sourceCodeEnd":145,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/sshkey.go#L116-L145","documentation":"After building the keypairs.CreateOpts, RenderOpenstack calls t.Cloud.CreateKeypair to create the keypair in OpenStack Nova. This error wraps any failure returned by that OpenStack API call, meaning the keypair could not be created in the project (quota, duplicate name with different key, or API/auth problem).","triggerScenarios":"RenderOpenstack with a == nil calls t.Cloud.CreateKeypair(opt) and the Nova API returns an error: 409 conflict (keypair name already exists), 401/403 (auth or RBAC), 413/over quota (max keypair limit per project reached), or 5xx/network failure.","commonSituations":"A keypair with the sanitized name (dots replaced with '-', colons with '_') already exists in the OpenStack project but wasn't found by Find (different project/region or name-collision with a manually created key); project hit its keypair quota; expired OpenStack credentials/token; Nova endpoint unreachable.","solutions":["Check for an existing conflicting keypair: `openstack keypair list` and delete the stale one if it belongs to this cluster: `openstack keypair delete <name>`.","Check quota: `openstack quota show` — if keypairs are at the limit, raise it or delete unused keys.","Re-authenticate / verify OS_* credentials and that the token is valid and scoped to the right project.","Inspect the wrapped gophercloud error for the HTTP status; if 5xx or timeout, retry `kops update cluster` once the Nova service is healthy."],"exampleFix":"# before: stale keypair blocks creation\n$ openstack keypair list | grep mycluster-me-mydomain-com\n# after: remove it and re-run kops\n$ openstack keypair delete mycluster-me-mydomain-com\n$ kops update cluster --name mycluster...","handlingStrategy":"try-catch","validationCode":"// Pre-check for an existing conflicting keypair and quota before creating:\nkp, err := cloud.GetKeypair(name)\nif err != nil { return err }\nif kp != nil {\n\treturn fmt.Errorf(\"keypair %q already exists (fingerprint %s); delete it or reuse it\", name, kp.Fingerprint)\n}","typeGuard":null,"tryCatchPattern":"v, err := t.Cloud.CreateKeypair(opt)\nif err != nil {\n\tvar gerr gophercloud.ErrUnexpectedResponseCode\n\tif errors.As(err, &gerr) {\n\t\tswitch gerr.Actual {\n\t\tcase http.StatusConflict:\n\t\t\treturn fmt.Errorf(\"keypair %q already exists: delete it with `openstack keypair delete %s` and retry\", opt.Name, opt.Name)\n\t\tcase http.StatusRequestEntityTooLarge, http.StatusForbidden:\n\t\t\treturn fmt.Errorf(\"keypair quota/limit hit for project: raise keypair quota and retry: %w\", err)\n\t\tcase http.StatusUnauthorized:\n\t\t\treturn fmt.Errorf(\"openstack auth failed, re-check OS_* credentials: %w\", err)\n\t\t}\n\t}\n\treturn fmt.Errorf(\"Error creating keypair: %w\", err)\n}","preventionTips":["Before apply, run `openstack keypair list` to catch name collisions (remember kOps replaces '.' with '-' and ':' with '_').","Monitor keypair quota (`openstack quota show`) in the project.","Keep OpenStack credentials/token fresh; test with `openstack token issue`.","Delete keypairs from old/destroyed clusters to avoid stale-name conflicts."],"tags":["openstack","keypair","nova","api-error"],"backgroundTag":"openstack-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}