kubernetes/kops · error

error listing KeyPairs: %v

Error message

error listing KeyPairs: %v

What it means

ListKeypairs calls ec2:DescribeKeyPairs (unfiltered, intentionally listing all keypairs per the TODO comment) and wraps any failure in this error. It means the keypair enumeration failed, blocking discovery of cluster keypairs. The raw AWS error is embedded via %v.

Source

Thrown at pkg/resources/aws/aws.go:708

func ListKeypairs(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	if !strings.Contains(clusterName, ".") {
		klog.Infof("cluster %q is legacy (kube-up) cluster; won't delete keypairs", clusterName)
		return nil, nil
	}

	c := cloud.(awsup.AWSCloud)

	keypairName := "kubernetes." + clusterName

	klog.V(2).Infof("Listing EC2 Keypairs")

	// TODO: We need to match both the name and a prefix
	// TODO: usee 'Filters: []*ec2.Filter{awsup.NewEC2Filter("key-name", keypairName)},'
	request := &ec2.DescribeKeyPairsInput{}
	response, err := c.EC2().DescribeKeyPairs(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing KeyPairs: %v", err)
	}

	var resourceTrackers []*resources.Resource

	for _, keypair := range response.KeyPairs {
		name := aws.ToString(keypair.KeyName)
		id := aws.ToString(keypair.KeyPairId)
		if name != keypairName && !strings.HasPrefix(name, keypairName+"-") {
			continue
		}
		resourceTracker := &resources.Resource{
			Name:    name,
			ID:      id,
			Type:    "keypair",
			Deleter: DeleteKeypair,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DescribeKeyPairs in the caller's IAM policy.
2. Refresh/fix AWS credentials and confirm the target region.
3. Retry with backoff on throttling errors.
4. Verify network path (proxy/VPC endpoint) to the EC2 endpoint.

_, err := ec2Client.DescribeKeyPairs(ctx, &ec2.DescribeKeyPairsInput{KeyNames: []string{"probe-if-allowed"}})
if isAuthError(err) { return fmt.Errorf("IAM lacks ec2:DescribeKeyPairs: %w", err) }

func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "UnauthorizedOperation" || ae.ErrorCode() == "AuthFailure") }

if err != nil {
  if isThrottling(err) { return backoffRetry() }
  if isAuthError(err) { return fmt.Errorf("fix IAM ec2:DescribeKeyPairs: %w", err) }
  return err
}

When it happens

Trigger: ec2.DescribeKeyPairs returns an error: UnauthorizedOperation/AuthFailure (missing ec2:DescribeKeyPairs permission), RequestLimitExceeded throttling, invalid credentials, or regional endpoint/network failure.

Common situations: Restricted IAM policies on CI runners listing clusters; throttling in accounts with many automation jobs; stale/expired credentials; VPC endpoint or proxy blocking EC2 API access.

Related errors

• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v
• error describing addresses: %v
• error describing volumes: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/16725432c1ef7ea8. Report an issue: GitHub.