kubernetes/kops · error

error building ssh key: %v

Error message

error building ssh key: %v

What it means

During `kops update cluster` with the Spotinst feature enabled, buildElastigroup links the cluster's SSH public key to the Elastigroup task via b.LinkToSSHKey(). This wrapper fires when LinkToSSHKey fails, i.e. the cluster spec defines no usable SSH key or the key task cannot be resolved. It aborts creation of the Elastigroup (control-plane/bastion/node) task.

Source

Thrown at pkg/model/awsmodel/spotinst.go:305

	if err != nil {
		return fmt.Errorf("error building root volume options: %v", err)
	}

	// Tenancy.
	if ig.Spec.Tenancy != "" {
		group.Tenancy = new(ig.Spec.Tenancy)
	}

	// Security groups.
	group.SecurityGroups, err = b.buildSecurityGroups(c, ig)
	if err != nil {
		return fmt.Errorf("error building security groups: %v", err)
	}

	// SSH key.
	group.SSHKey, err = b.LinkToSSHKey()
	if err != nil {
		return fmt.Errorf("error building ssh key: %v", err)
	}

	// Load balancers.
	group.LoadBalancers, group.TargetGroups, err = b.buildLoadBalancers(c, ig)
	if err != nil {
		return fmt.Errorf("error building load balancers: %v", err)
	}

	// User data.
	group.UserData, err = b.BootstrapScriptBuilder.ResourceNodeUp(c, ig)
	if err != nil {
		return fmt.Errorf("error building user data: %v", err)
	}

	// Public IP.
	group.AssociatePublicIPAddress, err = b.buildPublicIPOpts(ig)
	if err != nil {
		return fmt.Errorf("error building public ip options: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set cluster.spec.sshKeyName (or recreate the cluster with --ssh-public-key) and run `kops update cluster` again.
2. Verify the SSH public key exists in the kops state store (`kops get secrets sshpublickey`) and re-add with `kops create secret sshpublickey admin -i ~/.ssh/id_rsa.pub --name <cluster>` if missing.
3. If SSH keys are intentionally not used, confirm the Spotinst model path supports your configuration or disable the Spotinst feature flags.
4. Inspect the wrapped inner error (%v) to distinguish 'no SSH key defined' from key-store access problems.

Example fix

// before (cluster.yaml)
# sshKeyName: (absent)
// after
spec:
  sshKeyName: my-key

if cluster.Spec.SSHKeyName == "" {
  return fmt.Errorf("cluster %s must define spec.sshKeyName before Spotinst update", cluster.Name)
}

if err := updateCluster(); err != nil {
  if strings.Contains(err.Error(), "error building ssh key") {
    // re-add sshpublickey secret, then retry
  }
}

When it happens

Trigger: Running `kops update cluster` on a cluster using Spotinst Elastigroups where cluster.spec.sshKeyName is empty, the referenced SSH public key asset does not exist in the key store, or the ssh public key task was not built earlier in the model context.

Common situations: Clusters created with `--ssh-public-key` omitted; SSH key deleted from the kops state store; spec edits that removed sshKeyName while Spotinst feature flag remains enabled.

Related errors

• error building load balancers: %v
• error building public ip options: %v
• error building subnets: %v
• error building cloud tags: %v
• error building launch spec: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a7b62be66620d4c8. Report an issue: GitHub.