kubernetes/kops · error
error listing keypair: %v
Error message
error listing keypair: %v
What it means
getKeypair wraps errors from keypairs.Get (Nova os-keypairs API) with this message, except when the keypair is simply not found (404), which returns nil,nil. Any other failure — auth, connectivity, API error — during the readBackoff retry loop surfaces as this error.
Source
Thrown at upup/pkg/fi/cloudup/openstack/keypair.go:40
"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/keypairs"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/kops/util/pkg/vfs"
)
func (c *openstackCloud) GetKeypair(name string) (*keypairs.KeyPair, error) {
return getKeypair(c, name)
}
func getKeypair(c OpenstackCloud, name string) (*keypairs.KeyPair, error) {
var k *keypairs.KeyPair
done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
rs, err := keypairs.Get(context.TODO(), c.ComputeClient(), name, nil).Extract()
if err != nil {
if isNotFound(err) {
return true, nil
}
return false, fmt.Errorf("error listing keypair: %v", err)
}
k = rs
return true, nil
})
if err != nil {
return k, err
} else if done {
return k, nil
} else {
return k, wait.ErrWaitTimeout
}
}
func (c *openstackCloud) CreateKeypair(opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {
return createKeypair(c, opt)
}
func createKeypair(c OpenstackCloud, opt keypairs.CreateOptsBuilder) (*keypairs.KeyPair, error) {View on GitHub (pinned to 4c8573c808)
Solutions
- Read the wrapped %v error to identify auth vs connectivity vs policy failure
- Re-authenticate (valid OS_* credentials/clouds.yaml) if it's a 401
- If 403, grant the project/service user permission to read keypairs or pre-provision the keypair under the expected name
- Retry after fixing connectivity; a 404 is already handled as 'keypair absent', not an error
Defensive patterns
Strategy: try-catch
Validate before calling
// confirm auth and keypair visibility before lookups
err := shell.Exec("openstack keypair show " + keypairName) // non-404 failures caught here early Try / catch
k, err := GetKeypair(cloud, name)
if err != nil {
if strings.Contains(err.Error(), "error listing keypair") {
// treat as transient/API issue; note: not-found returns (nil, nil) already
return retryAfterBackoff(func() error { _, err = GetKeypair(cloud, name); return err })
}
return err
} Prevention
- Refresh tokens before long-running cluster operations
- Pre-provision SSH keypairs under kops' expected name so 404 (absent) is the common path
- Verify RBAC allows keypair reads for the service user
- Distinguish 404 (handled) from other statuses in wrapped error strings
When it happens
Trigger: keypairs.Get fails with a non-404 error: invalid/expired token, compute endpoint unreachable, or Nova keypair API returning 403/5xx while looking up the named keypair.
Common situations: Cluster SSH key lookup during instance creation with expired Keystone credentials; hardened RBAC policy denying keypair GET; network outage to the compute API.
Related errors
- error creating keypair: %v
- failed to list ssh keys: %w
- failed to delete ssh key %s(%s): %w
- exactly one 'admin' SSH public key can be specified when run
- error listing Akamai (Linode) SSH keys: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/d49face6af8e710d.
Report an issue: GitHub.