kubernetes/kops · error
error creating keypair: %v
Error message
error creating keypair: %v
What it means
createKeypair wraps any error from keypairs.Create (Nova os-keypairs create API) with this message. The call is retried under vfs.RetryWithBackoff(writeBackoff); if all retries fail, the last error is returned wrapped.
Source
Thrown at upup/pkg/fi/cloudup/openstack/keypair.go:64
return k, err
} else if done {
return k, nil
} else {
return k, wait.ErrWaitTimeout
}
}
func (c *openstackCloud) CreateKeypair(opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {
return createKeypair(c, opt)
}
func createKeypair(c OpenstackCloud, opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {
var k *keypairs.KeyPair
done, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {
v, err := keypairs.Create(context.TODO(), c.ComputeClient(), opt).Extract()
if err != nil {
return false, fmt.Errorf("error creating keypair: %v", err)
}
k = v
return true, nil
})
if err != nil {
return k, err
} else if done {
return k, nil
} else {
return k, wait.ErrWaitTimeout
}
}
func (c *openstackCloud) DeleteKeyPair(name string) error {
return deleteKeyPair(c, name)
}
func deleteKeyPair(c OpenstackCloud, name string) error {View on GitHub (pinned to 4c8573c808)
Solutions
- Check the wrapped %v error: 409 conflict means the keypair already exists — verify it matches the intended key or delete/rename it
- Validate the SSH public key material (OpenSSH format) before import if it's a 400
- Fix credentials/permissions (401/403) for the user kops authenticates as
- Retry after resolving; note conflicts will keep failing on every retry, so resolve the duplicate rather than re-running
Example fix
// before: keypair import with bad key material
opt := keypairs.CreateOpts{Name: name, PublicKey: "not-a-key"}
// after: valid OpenSSH public key
pub, _ := os.ReadFile("~/.ssh/id_rsa.pub")
opt := keypairs.CreateOpts{Name: name, PublicKey: strings.TrimSpace(string(pub))} Defensive patterns
Strategy: validation
Validate before calling
// avoid the create if the keypair already exists
existing, err := GetKeypair(cloud, name)
if err != nil { return err }
if existing != nil {
return nil // already created; skip create to avoid 409 conflict
} Prevention
- Always check keypair existence before creating (create is not idempotent — 409 on duplicates)
- Validate public key material is valid OpenSSH before importing
- Ensure the kops service user has keypair:create permission
- Prefer importing an existing key over generating a new one per run to keep state stable
When it happens
Trigger: keypairs.Create fails: keypair with the same name already exists (409), invalid public key material (400), token invalid (401), or policy denies keypair creation (403).
Common situations: Re-running cluster creation where the keypair already exists in the project; importing a malformed/unsupported SSH public key; service user lacking keypair:create permission.
Related errors
- error listing keypair: %v
- failed to list ssh keys: %w
- failed to delete ssh key %s(%s): %w
- exactly one 'admin' SSH public key can be specified when run
- error listing Akamai (Linode) SSH keys: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/bf842bb8f2c1a97e.
Report an issue: GitHub.