kubernetes/kops · error

Error creating keypair: %v

Error message

Error creating keypair: %v

What it means

After building the keypairs.CreateOpts, RenderOpenstack calls t.Cloud.CreateKeypair to create the keypair in OpenStack Nova. This error wraps any failure returned by that OpenStack API call, meaning the keypair could not be created in the project (quota, duplicate name with different key, or API/auth problem).

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/sshkey.go:134

func (_ *SSHKey) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SSHKey) error {
	if a == nil {
		klog.V(2).Infof("Creating Keypair with name:%q", fi.ValueOf(e.Name))

		opt := keypairs.CreateOpts{
			Name: openstackKeyPairName(fi.ValueOf(e.Name)),
		}

		if e.PublicKey != nil {
			d, err := fi.ResourceAsString(e.PublicKey)
			if err != nil {
				return fmt.Errorf("error rendering SSHKey PublicKey: %v", err)
			}
			opt.PublicKey = d
		}

		v, err := t.Cloud.CreateKeypair(opt)
		if err != nil {
			return fmt.Errorf("Error creating keypair: %v", err)
		}

		e.KeyFingerprint = new(v.Fingerprint)
		klog.V(2).Infof("Creating a new Openstack keypair, id=%s", v.Fingerprint)
		return nil
	}
	e.KeyFingerprint = a.KeyFingerprint
	klog.V(2).Infof("Using an existing Openstack keypair, id=%s", fi.ValueOf(e.KeyFingerprint))
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check for an existing conflicting keypair: `openstack keypair list` and delete the stale one if it belongs to this cluster: `openstack keypair delete <name>`.
2. Check quota: `openstack quota show` — if keypairs are at the limit, raise it or delete unused keys.
3. Re-authenticate / verify OS_* credentials and that the token is valid and scoped to the right project.
4. Inspect the wrapped gophercloud error for the HTTP status; if 5xx or timeout, retry `kops update cluster` once the Nova service is healthy.

Example fix

# before: stale keypair blocks creation
$ openstack keypair list | grep mycluster-me-mydomain-com
# after: remove it and re-run kops
$ openstack keypair delete mycluster-me-mydomain-com
$ kops update cluster --name mycluster...

// Pre-check for an existing conflicting keypair and quota before creating:
kp, err := cloud.GetKeypair(name)
if err != nil { return err }
if kp != nil {
	return fmt.Errorf("keypair %q already exists (fingerprint %s); delete it or reuse it", name, kp.Fingerprint)
}

v, err := t.Cloud.CreateKeypair(opt)
if err != nil {
	var gerr gophercloud.ErrUnexpectedResponseCode
	if errors.As(err, &gerr) {
		switch gerr.Actual {
		case http.StatusConflict:
			return fmt.Errorf("keypair %q already exists: delete it with `openstack keypair delete %s` and retry", opt.Name, opt.Name)
		case http.StatusRequestEntityTooLarge, http.StatusForbidden:
			return fmt.Errorf("keypair quota/limit hit for project: raise keypair quota and retry: %w", err)
		case http.StatusUnauthorized:
			return fmt.Errorf("openstack auth failed, re-check OS_* credentials: %w", err)
		}
	}
	return fmt.Errorf("Error creating keypair: %w", err)
}

When it happens

Trigger: RenderOpenstack with a == nil calls t.Cloud.CreateKeypair(opt) and the Nova API returns an error: 409 conflict (keypair name already exists), 401/403 (auth or RBAC), 413/over quota (max keypair limit per project reached), or 5xx/network failure.

Common situations: A keypair with the sanitized name (dots replaced with '-', colons with '_') already exists in the OpenStack project but wasn't found by Find (different project/region or name-collision with a manually created key); project hit its keypair quota; expired OpenStack credentials/token; Nova endpoint unreachable.

Related errors

• error creating server group: %v
• error listing server groups: %v
• error deleting server group: %v
• error building nova client: %v
• error listing KeyPairs: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/605a02177a71b8ac. Report an issue: GitHub.