kubernetes/kops · error

expected at most one SSH public key; found %d keys

Error message

expected at most one SSH public key; found %d keys

What it means

The model context carries more than one SSH public key, but Azure VM scale sets accept at most one key per scale set; key collection produced multiple entries.

Source

Thrown at pkg/model/azuremodel/vmscaleset.go:142

		return nil, fmt.Errorf("unexpected instance group role for instance group: %q, %q", ig.Name, ig.Spec.Role)
	}

	var err error
	if t.Capacity, err = getCapacity(&ig.Spec); err != nil {
		return nil, err
	}

	sp, err := getStorageProfile(&ig.Spec)
	if err != nil {
		return nil, err
	}
	t.StorageProfile = &azuretasks.VMScaleSetStorageProfile{
		VirtualMachineScaleSetStorageProfile: sp,
	}

	if n := len(b.SSHPublicKeys); n > 0 {
		if n > 1 {
			return nil, fmt.Errorf("expected at most one SSH public key; found %d keys", n)
		}
		t.SSHPublicKey = new(string(b.SSHPublicKeys[0]))
	}

	if t.UserData, err = b.BootstrapScriptBuilder.ResourceNodeUp(c, ig); err != nil {
		return nil, err
	}

	subnets, err := b.GatherSubnets(ig)
	if err != nil {
		return nil, err
	}
	if len(subnets) != 1 {
		return nil, fmt.Errorf("expected exactly one subnet for InstanceGroup %q; subnets was %s", ig.Name, ig.Spec.Subnets)
	}
	subnet := subnets[0]
	t.Subnet = b.LinkToAzureSubnet(subnet)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Configure a single SSH public key for the cluster
2. Remove extra keys from the cluster spec or key sources
3. Re-run kops update

When it happens

Trigger: Thrown at pkg/model/azuremodel/vmscaleset.go:142 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8b5b41041ffeb615. Report an issue: GitHub.