What causes "error creating Akamai (Linode) SSH key %q: %w" in kubernetes/kops?

Verify the Linode API token is valid and has write scopes (check LINODE_API_TOKEN env var)

error creating Akamai (Linode) SSH key %q: %w

Error message

error creating Akamai (Linode) SSH key %q: %w

What it means

SSHKey.RenderLinode wraps the linodego CreateSSHKey error when uploading a new SSH public key to the Akamai (Linode) account. It fires when the API rejects creation — invalid key material, duplicate label, auth, or rate limits — leaving the task unable to create the key.

Source

Thrown at upup/pkg/fi/cloudup/linodetasks/sshkey.go:148

	if name == "" {
		return fi.RequiredField("Name")
	}

	if expected.PublicKey == nil {
		return fi.RequiredField("PublicKey")
	}

	publicKey, err := fi.ResourceAsString(*expected.PublicKey)
	if err != nil {
		return fmt.Errorf("error rendering SSH key data: %w", err)
	}

	created, err := t.Cloud.Client().CreateSSHKey(context.Background(), linodego.SSHKeyCreateOptions{
		Label:  name,
		SSHKey: strings.TrimSpace(publicKey),
	})
	if err != nil {
		return fmt.Errorf("error creating Akamai (Linode) SSH key %q: %w", name, err)
	}

	expected.ID = new(created.ID)
	klog.V(2).Infof("Created Akamai (Linode) SSH key %q (id=%d)", created.Label, created.ID)

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Verify the Linode API token is valid and has write scopes (check LINODE_API_TOKEN env var)
Check the wrapped inner error for HTTP status; retry after a 429 rate limit
Validate the public key format is a valid OpenSSH public key
Check https://status.linode.com for API incidents

Example fix

// before
export LINODE_API_TOKEN=expired-token
// after
export LINODE_API_TOKEN=$(cat ~/.linode-token)  # fresh token with RW scope

Defensive patterns

Strategy: retry

Validate before calling

if os.Getenv("LINODE_API_TOKEN") == "" { return errors.New("LINODE_API_TOKEN not set") }
// optionally: ping the API with client.ListSSHKeys before creating

Try / catch

created, err := client.CreateSSHKey(ctx, opts)
if err != nil {
    if lw, ok := err.(*linodego.Error); ok && lw.Code == 429 {
        time.Sleep(retryAfter); return retry()
    }
    return fmt.Errorf("error creating Akamai (Linode) SSH key %q: %w", name, err)
}

Prevention

Use a fresh Linode API token with RW scopes
Add exponential backoff for 429/5xx responses
Validate key format before upload
Watch Linode status page during CI runs

When it happens

Trigger: cloud.Client().CreateSSHKey returns an error — e.g. invalid Linode API token, 429 rate limit, or the SSHKey payload is rejected by the API.

Common situations: Expired/incorrect LINODE_API_TOKEN, account hitting SSH key limits, or network/API outage during kops update.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6c3282f77509543a. Report an issue: GitHub.