kubernetes/kops · error

error creating SSHKey: %v

Error message

error creating SSHKey: %v

What it means

createKeypair calls ec2.ImportKeyPair to register the public key with AWS; any API failure is wrapped as "error creating SSHKey". Note ImportKeyPair does NOT fail on duplicate names in modern EC2 (it errors InvalidKeyPair.Duplicate only in some paths), so most failures are permission, format, or throttling related.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sshkey.go:169

	ctx := context.TODO()
	klog.V(2).Infof("Creating SSHKey with Name:%q", *e.Name)

	request := &ec2.ImportKeyPairInput{
		KeyName:           e.Name,
		TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeKeyPair, e.Tags),
	}

	if e.PublicKey != nil {
		d, err := fi.ResourceAsBytes(e.PublicKey)
		if err != nil {
			return fmt.Errorf("error rendering SSHKey PublicKey: %v", err)
		}
		request.PublicKeyMaterial = d
	}

	response, err := cloud.EC2().ImportKeyPair(ctx, request)
	if err != nil {
		return fmt.Errorf("error creating SSHKey: %v", err)
	}

	e.KeyFingerprint = response.KeyFingerprint
	e.ID = response.KeyPairId

	return nil
}

func (_ *SSHKey) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SSHKey) error {
	if a == nil {
		return e.createKeypair(t.Cloud)
	}

	if !e.Shared {
		return t.AddAWSTags(*e.ID, e.Tags)
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error code and fix accordingly (IAM permission vs. key format).
2. Add ec2:ImportKeyPair to the kOps IAM policy if UnauthorizedOperation.
3. Validate the key locally: ssh-keygen -l -f id_rsa.pub; re-export if malformed.
4. Retry the apply on throttling/transient errors.

Example fix

// before
{"Action":["ec2:CreateKeyPair","ec2:DescribeKeyPairs"]}
// after
{"Action":["ec2:CreateKeyPair","ec2:ImportKeyPair","ec2:DescribeKeyPairs","ec2:DeleteKeyPair"]}

// pre-flight: permission and key-format checks
aws iam simulate-principal-policy --policy-source-arn <kopsRoleArn> --action-names ec2:ImportKeyPair
ssh-keygen -l -f ~/.ssh/id_rsa.pub

out, err := runKopsApply()
if err != nil && strings.Contains(out, "error creating SSHKey") {
    switch {
    case strings.Contains(out, "UnauthorizedOperation"):
        return fmt.Errorf("add ec2:ImportKeyPair to the kOps IAM policy")
    case strings.Contains(out, "InvalidPublicKeyMaterial") || strings.Contains(out, "malformed"):
        return fmt.Errorf("fix the public key format before retrying")
    default:
        return retryWithBackoff(runKopsApply) // transient/throttling
    }
}

When it happens

Trigger: cloud.EC2().ImportKeyPair returns an error: UnauthorizedOperation (missing ec2:ImportKeyPair), InvalidPublicKeyMaterial.Malformed (bad key format), throttling, or unsupported key format for the region.

Common situations: kOps IAM policy missing ec2:ImportKeyPair; key generated with an algorithm EC2 rejects; passing a private key's bytes; transient AWS errors during large applies.

Related errors

• error listing SSHKeys: %v
• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v
• error describing addresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/834a57791e522f87. Report an issue: GitHub.