kubernetes/kops · error

exactly one 'admin' SSH public key can be specified when run

Error message

exactly one 'admin' SSH public key can be specified when running with AWS; please delete a key using `kops delete secret`

What it means

For AWS clusters kOps uploads exactly one 'admin' SSH key pair; the state store contains more than one admin sshpublickey, making the choice ambiguous, so the apply is rejected.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:456

	case kops.CloudProviderDO:
		{
			if len(sshPublicKeys) == 0 && (c.Cluster.Spec.SSHKeyName == nil || *c.Cluster.Spec.SSHKeyName == "") {
				return nil, fmt.Errorf("SSH public key must be specified when running with DigitalOcean (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)", cluster.ObjectMeta.Name)
			}
		}
	case kops.CloudProviderAWS:
		{
			awsCloud := cloud.(awsup.AWSCloud)

			accountID, partition, err := awsCloud.AccountInfo(ctx)
			if err != nil {
				return nil, err
			}
			modelContext.AWSAccountID = accountID
			modelContext.AWSPartition = partition

			if len(sshPublicKeys) > 1 {
				return nil, fmt.Errorf("exactly one 'admin' SSH public key can be specified when running with AWS; please delete a key using `kops delete secret`")
			}
		}

	case kops.CloudProviderAzure:
		{
			if !featureflag.Azure.Enabled() {
				return nil, fmt.Errorf("azure support is currently alpha, and is feature-gated. Please export KOPS_FEATURE_FLAGS=Azure")
			}

			if len(sshPublicKeys) == 0 {
				return nil, fmt.Errorf("SSH public key must be specified when running with AzureCloud (create with `kops create secret --name %s sshpublickey admin -i ~/.ssh/id_rsa.pub`)", cluster.ObjectMeta.Name)
			}

			if len(sshPublicKeys) != 1 {
				return nil, fmt.Errorf("exactly one 'admin' SSH public key can be specified when running with AzureCloud; please delete a key using `kops delete secret`")
			}
		}
	case kops.CloudProviderOpenstack:

View on GitHub (pinned to 4c8573c808)

Solutions

1. List keys with `kops get secrets` and remove extras: `kops delete secret sshpublickey <name>`
2. Keep exactly one admin public key in the state store

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/apply_cluster.go:456 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a13cec92cd1e31f3. Report an issue: GitHub.