exactly one 'admin' SSH public key can be specified when run

Error message

exactly one 'admin' SSH public key can be specified when running with Openstack; please delete a key using `kops delete secret`

What it means

kOps's cluster apply (upup/pkg/fi/cloudup/apply_cluster.go, Run) requires that OpenStack clusters have exactly one SSH public key secret named 'admin'. The sshPublicKeys map (loaded from cluster secrets) must contain one entry; zero keys or more than one key both abort the apply. This exists because the OpenStack provisioning path injects a single admin keypair into instances and cannot disambiguate multiple keys.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:481

				return nil, fmt.Errorf("azure support is currently alpha, and is feature-gated. Please export KOPS_FEATURE_FLAGS=Azure")
			}

			if len(sshPublicKeys) == 0 {
				return nil, fmt.Errorf("SSH public key must be specified when running with AzureCloud (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)", cluster.ObjectMeta.Name)
			}

			if len(sshPublicKeys) != 1 {
				return nil, fmt.Errorf("exactly one 'admin' SSH public key can be specified when running with AzureCloud; please delete a key using `kops delete secret`")
			}
		}
	case kops.CloudProviderOpenstack:
		{
			if len(sshPublicKeys) == 0 {
				return nil, fmt.Errorf("SSH public key must be specified when running with Openstack (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)", cluster.ObjectMeta.Name)
			}

			if len(sshPublicKeys) != 1 {
				return nil, fmt.Errorf("exactly one 'admin' SSH public key can be specified when running with Openstack; please delete a key using `kops delete secret`")
			}
		}

	case kops.CloudProviderScaleway:
		{
			if !featureflag.Scaleway.Enabled() {
				return nil, fmt.Errorf("Scaleway support is currently alpha, and is feature-gated.  export KOPS_FEATURE_FLAGS=Scaleway")
			}

			if len(sshPublicKeys) == 0 {
				return nil, fmt.Errorf("SSH public key must be specified when running with Scaleway (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)", cluster.ObjectMeta.Name)
			}
			if len(sshPublicKeys) != 1 {
				return nil, fmt.Errorf("exactly one 'admin' SSH public key can be specified when running with Scaleway; please delete a key using `kops delete secret`")
			}

			scwCloud := cloud.(scaleway.ScwCloud)
			scwZone = scwCloud.Zone()

View on GitHub (pinned to 4c8573c808)

Solutions

Ensure exactly one key exists: delete extra keys with `kops delete secret sshpublickey <name> --name <cluster>` then `kops update cluster` again
If no key exists, add one: `kops create secret --name <cluster> sshpublickey admin -i ~/.ssh/id_rsa.pub`
List current keys with `kops get secrets --type secret` to see which entries to remove

Example fix

// before: two sshpublickey secrets (admin, extra)
kops delete secret sshpublickey extra --name mycluster.example.com
// after: only 'admin' remains; kops update cluster succeeds

Defensive patterns

Strategy: validation

Validate before calling

keys=$(kops get secrets --type secret -o name | grep sshpublickey | wc -l); [ "$keys" -eq 1 ] || echo "need exactly 1 sshpublickey, found $keys"

Try / catch

if err := kops.UpdateCluster(ctx, cluster); err != nil { if strings.Contains(err.Error(), "exactly one 'admin' SSH public key") { /* reconcile secrets then retry */ } return err }

Prevention

Keep only the single 'admin' sshpublickey secret per openstack cluster
Audit secrets with `kops get secrets` before `kops update cluster`
Automate key creation in bootstrap scripts: create secret if absent, never add extra names

When it happens

Trigger: Running `kops update cluster` (via RunUpdateCluster/Run) for a cluster with cloudProvider=openstack while the 'sshpublickey' secret store holds zero entries or 2+ entries (e.g. multiple named keys).

Common situations: Users created several SSH key secrets over time (e.g. re-adding 'admin' plus a personal key) or imported keys from an old cluster; also fresh clusters where the key was never created.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/03a3a5ff8290f30a. Report an issue: GitHub.