kubernetes/kops · error

failed to find ssh keys for server group %q

Error message

failed to find ssh keys for server group %q

What it means

Before creating servers for a Hetzner server group, kOps requires at least one SSH key to be attached. RenderHetzner in servergroup.go:202 throws this when e.SSHKeys is empty — no SSH keys were resolved or specified for the server group, so instances would be inaccessible via SSH.

Source

Thrown at upup/pkg/fi/cloudup/hetznertasks/servergroup.go:202

			})
			if err != nil {
				return err
			}
		}
	}

	actualCount := 0
	if a != nil {
		actualCount = a.Count
	}
	expectedCount := e.Count

	if actualCount >= expectedCount {
		return nil
	}

	if len(e.SSHKeys) == 0 {
		return fmt.Errorf("failed to find ssh keys for server group %q", fi.ValueOf(e.Name))
	}
	if e.Network == nil {
		return fmt.Errorf("failed to find network for server group %q", fi.ValueOf(e.Name))
	}

	userData, err := fi.ResourceAsString(e.UserData)
	if err != nil {
		return err
	}
	userDataBytes, err := fi.ResourceAsBytes(e.UserData)
	if err != nil {
		return err
	}
	userDataHash := SafeBytesHash(userDataBytes)

	networkID, err := strconv.ParseInt(fi.ValueOf(e.Network.ID), 10, 64)
	if err != nil {
		return fmt.Errorf("failed to convert network ID %q to int: %w", fi.ValueOf(e.Network.ID), err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add SSH public keys to the cluster spec under the Hetzner cloud configuration so the server group gets SSHKeys populated.
2. Ensure the referenced SSH keys exist in the Hetzner project (`hcloud ssh-key list`) and match by name.
3. Re-run `kops update cluster` after fixing the config.
4. Check that the SSHKey task rendering order precedes the ServerGroup task so keys resolve before server creation.

Example fix

// before (cluster spec)
sshPublicKeys: []
// after
sshPublicKeys:
  - "ssh-ed25519 AAAA... user@host"

if len(cluster.Spec.SSHPublicKeys) == 0 {
	return fmt.Errorf("cluster spec must define at least one SSH public key for Hetzner server groups")
}
for _, key := range cluster.Spec.SSHPublicKeys {
	if !strings.HasPrefix(key, "ssh-") {
		return fmt.Errorf("invalid SSH public key format")
	}
}

When it happens

Trigger: RenderHetzner in upup/pkg/fi/cloudup/hetznertasks/servergroup.go:202 checks len(e.SSHKeys) == 0 during scale-up/creation (actualCount < expectedCount) and aborts because the server group task has no SSHKeys populated.

Common situations: Cluster spec omits sshKeys for the Hetzner cloud provider; SSH key task failed to find matching keys in Hetzner so the list ended up empty; config migrated from another provider without Hetzner SSH key entries.

Related errors

• failed to find network for server group %q
• spec.PublicKey is required
• error adding SSH public key: %v
• host is required
• hostname was empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a2297cbb4a11e125. Report an issue: GitHub.