kubernetes/kops · error

error listing SSHKeys: %v

Error message

error listing SSHKeys: %v

What it means

SSHKey.find calls ec2.DescribeKeyPairs to locate the key by name. Any API error other than InvalidKeyPair.NotFound aborts the Find with "error listing SSHKeys". Find is what lets kOps compare cloud state to the spec, so this blocks reconciliation of SSH keys entirely.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sshkey.go:69

func (e *SSHKey) CompareWithID() *string {
	return e.Name
}

func (e *SSHKey) Find(c *fi.CloudupContext) (*SSHKey, error) {
	cloud := awsup.GetCloud(c)

	return e.find(c.Context(), cloud)
}

func (e *SSHKey) find(ctx context.Context, cloud awsup.AWSCloud) (*SSHKey, error) {
	request := &ec2.DescribeKeyPairsInput{
		KeyNames: []string{fi.ValueOf(e.Name)},
	}

	response, err := cloud.EC2().DescribeKeyPairs(ctx, request)
	if err != nil && awsup.AWSErrorCode(err) != "InvalidKeyPair.NotFound" {
		return nil, fmt.Errorf("error listing SSHKeys: %v", err)
	}

	if response == nil || len(response.KeyPairs) == 0 {
		if e.IsExistingKey() && *e.Name != "" {
			return nil, fmt.Errorf("unable to find specified SSH key %q", *e.Name)
		}
		return nil, nil
	}

	if len(response.KeyPairs) != 1 {
		return nil, fmt.Errorf("Found multiple SSHKeys with Name %q", *e.Name)
	}

	k := response.KeyPairs[0]
	actual := &SSHKey{
		ID:             k.KeyPairId,
		Name:           k.KeyName,
		KeyFingerprint: k.KeyFingerprint,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the wrapped AWS error: refresh credentials (aws sts get-caller-identity) or add ec2:DescribeKeyPairs to the IAM policy.
2. Retry after checking network/EC2 endpoint reachability from the machine running kOps.
3. If throttled, reduce concurrency or retry later.
4. Verify AWS_REGION/default region settings are valid.

Example fix

// before
export AWS_PROFILE=stale-profile
// after
export AWS_PROFILE=valid-profile && aws sts get-caller-identity

// verify credentials and permissions before kops
aws sts get-caller-identity
aws ec2 describe-key-pairs --query 'KeyPairs[].KeyName'

out, err := exec.Command("kops", "apply").CombinedOutput()
if err != nil && strings.Contains(string(out), "error listing SSHKeys") {
    // AWS-level auth/permission/network failure; surface wrapped code
    return fmt.Errorf("EC2 API unreachable during SSH key discovery: %s", out)
}

When it happens

Trigger: cloud.EC2().DescribeKeyPairs returns an error with a code other than InvalidKeyPair.NotFound: UnauthorizedOperation, AuthFailure (bad credentials), request throttling, or network failure to EC2.

Common situations: Expired/missing AWS credentials; kOps IAM role missing ec2:DescribeKeyPairs; corporate proxy or VPC endpoint blocking EC2 API; regional outage.

Related errors

• error creating SSHKey: %v
• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v
• error describing addresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9965cff965062a44. Report an issue: GitHub.