{"record":{"id":"a2297cbb4a11e125","repo":"kubernetes/kops","slug":"failed-to-find-ssh-keys-for-server-group-q","errorCode":null,"errorMessage":"failed to find ssh keys for server group %q","messagePattern":"failed to find ssh keys for server group %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/hetznertasks/servergroup.go","lineNumber":202,"sourceCode":"\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\tactualCount := 0\n\tif a != nil {\n\t\tactualCount = a.Count\n\t}\n\texpectedCount := e.Count\n\n\tif actualCount >= expectedCount {\n\t\treturn nil\n\t}\n\n\tif len(e.SSHKeys) == 0 {\n\t\treturn fmt.Errorf(\"failed to find ssh keys for server group %q\", fi.ValueOf(e.Name))\n\t}\n\tif e.Network == nil {\n\t\treturn fmt.Errorf(\"failed to find network for server group %q\", fi.ValueOf(e.Name))\n\t}\n\n\tuserData, err := fi.ResourceAsString(e.UserData)\n\tif err != nil {\n\t\treturn err\n\t}\n\tuserDataBytes, err := fi.ResourceAsBytes(e.UserData)\n\tif err != nil {\n\t\treturn err\n\t}\n\tuserDataHash := SafeBytesHash(userDataBytes)\n\n\tnetworkID, err := strconv.ParseInt(fi.ValueOf(e.Network.ID), 10, 64)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to convert network ID %q to int: %w\", fi.ValueOf(e.Network.ID), err)","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/hetznertasks/servergroup.go#L184-L220","documentation":"Before creating servers for a Hetzner server group, kOps requires at least one SSH key to be attached. RenderHetzner in servergroup.go:202 throws this when e.SSHKeys is empty — no SSH keys were resolved or specified for the server group, so instances would be inaccessible via SSH.","triggerScenarios":"RenderHetzner in upup/pkg/fi/cloudup/hetznertasks/servergroup.go:202 checks len(e.SSHKeys) == 0 during scale-up/creation (actualCount < expectedCount) and aborts because the server group task has no SSHKeys populated.","commonSituations":"Cluster spec omits sshKeys for the Hetzner cloud provider; SSH key task failed to find matching keys in Hetzner so the list ended up empty; config migrated from another provider without Hetzner SSH key entries.","solutions":["Add SSH public keys to the cluster spec under the Hetzner cloud configuration so the server group gets SSHKeys populated.","Ensure the referenced SSH keys exist in the Hetzner project (`hcloud ssh-key list`) and match by name.","Re-run `kops update cluster` after fixing the config.","Check that the SSHKey task rendering order precedes the ServerGroup task so keys resolve before server creation."],"exampleFix":"// before (cluster spec)\nsshPublicKeys: []\n// after\nsshPublicKeys:\n  - \"ssh-ed25519 AAAA... user@host\"","handlingStrategy":"validation","validationCode":"if len(cluster.Spec.SSHPublicKeys) == 0 {\n\treturn fmt.Errorf(\"cluster spec must define at least one SSH public key for Hetzner server groups\")\n}\nfor _, key := range cluster.Spec.SSHPublicKeys {\n\tif !strings.HasPrefix(key, \"ssh-\") {\n\t\treturn fmt.Errorf(\"invalid SSH public key format\")\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always define sshPublicKeys in the cluster spec before first `kops update cluster`.","Confirm keys exist in the Hetzner project via `hcloud ssh-key list`.","Keep SSH key entries in version control with the cluster spec."],"tags":["hetzner","ssh","servergroup","config","validation"],"backgroundTag":"missing-ssh-key","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}