{"record":{"id":"bf842bb8f2c1a97e","repo":"kubernetes/kops","slug":"error-creating-keypair-v","errorCode":null,"errorMessage":"error creating keypair: %v","messagePattern":"error creating keypair: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/keypair.go","lineNumber":64,"sourceCode":"\t\treturn k, err\n\t} else if done {\n\t\treturn k, nil\n\t} else {\n\t\treturn k, wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) CreateKeypair(opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {\n\treturn createKeypair(c, opt)\n}\n\nfunc createKeypair(c OpenstackCloud, opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {\n\tvar k *keypairs.KeyPair\n\n\tdone, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {\n\t\tv, err := keypairs.Create(context.TODO(), c.ComputeClient(), opt).Extract()\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error creating keypair: %v\", err)\n\t\t}\n\t\tk = v\n\t\treturn true, nil\n\t})\n\tif err != nil {\n\t\treturn k, err\n\t} else if done {\n\t\treturn k, nil\n\t} else {\n\t\treturn k, wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) DeleteKeyPair(name string) error {\n\treturn deleteKeyPair(c, name)\n}\n\nfunc deleteKeyPair(c OpenstackCloud, name string) error {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/keypair.go#L46-L82","documentation":"createKeypair wraps any error from keypairs.Create (Nova os-keypairs create API) with this message. The call is retried under vfs.RetryWithBackoff(writeBackoff); if all retries fail, the last error is returned wrapped.","triggerScenarios":"keypairs.Create fails: keypair with the same name already exists (409), invalid public key material (400), token invalid (401), or policy denies keypair creation (403).","commonSituations":"Re-running cluster creation where the keypair already exists in the project; importing a malformed/unsupported SSH public key; service user lacking keypair:create permission.","solutions":["Check the wrapped %v error: 409 conflict means the keypair already exists — verify it matches the intended key or delete/rename it","Validate the SSH public key material (OpenSSH format) before import if it's a 400","Fix credentials/permissions (401/403) for the user kops authenticates as","Retry after resolving; note conflicts will keep failing on every retry, so resolve the duplicate rather than re-running"],"exampleFix":"// before: keypair import with bad key material\nopt := keypairs.CreateOpts{Name: name, PublicKey: \"not-a-key\"}\n// after: valid OpenSSH public key\npub, _ := os.ReadFile(\"~/.ssh/id_rsa.pub\")\nopt := keypairs.CreateOpts{Name: name, PublicKey: strings.TrimSpace(string(pub))}","handlingStrategy":"validation","validationCode":"// avoid the create if the keypair already exists\nexisting, err := GetKeypair(cloud, name)\nif err != nil { return err }\nif existing != nil {\n    return nil // already created; skip create to avoid 409 conflict\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always check keypair existence before creating (create is not idempotent — 409 on duplicates)","Validate public key material is valid OpenSSH before importing","Ensure the kops service user has keypair:create permission","Prefer importing an existing key over generating a new one per run to keep state stable"],"tags":["openstack","keypairs","ssh","api"],"backgroundTag":"keypair-creation-conflict","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}