What causes "failed to list cluster ssh keys: %w" in kubernetes/kops?

Validate credentials with `scw iam ssh-key list` using the same access/secret keys kops uses.

failed to list cluster ssh keys: %w

Error message

failed to list cluster ssh keys: %w

What it means

Wrap-around error returned by GetClusterSSHKeys when the Scaleway IAM API ListSSHKeys (paginated) fails. The function filters returned keys by the `kubernetes.<clusterName>-` name prefix, so this error fires only on the API call itself, not on finding zero keys. The underlying SDK error is preserved with %w.

Source

Thrown at upup/pkg/fi/cloudup/scaleway/cloud.go:483

	if err != nil {
		if instanceGroupName != nil {
			return nil, fmt.Errorf("failed to list cluster servers named %q: %w", *instanceGroupName, err)
		}
		return nil, fmt.Errorf("failed to list cluster servers: %w", err)
	}
	return servers.Servers, nil
}

func (s *scwCloudImplementation) GetClusterSSHKeys(clusterName string) ([]*iam.SSHKey, error) {
	clusterSSHKeys := []*iam.SSHKey(nil)
	allSSHKeys, err := s.iamAPI.ListSSHKeys(&iam.ListSSHKeysRequest{}, scw.WithAllPages())
	for _, sshkey := range allSSHKeys.SSHKeys {
		if strings.HasPrefix(sshkey.Name, fmt.Sprintf("kubernetes.%s-", clusterName)) {
			clusterSSHKeys = append(clusterSSHKeys, sshkey)
		}
	}
	if err != nil {
		return nil, fmt.Errorf("failed to list cluster ssh keys: %w", err)
	}
	return clusterSSHKeys, nil
}

func (s *scwCloudImplementation) GetClusterVolumes(clusterName string) ([]*instance.Volume, error) {
	volumes, err := s.instanceAPI.ListVolumes(&instance.ListVolumesRequest{
		Zone: s.zone,
		Tags: []string{TagClusterName + "=" + clusterName},
	}, scw.WithAllPages())
	if err != nil {
		return nil, fmt.Errorf("failed to list cluster volumes: %w", err)
	}
	return volumes.Volumes, nil
}

func (s *scwCloudImplementation) GetServerIP(serverID string, zone scw.Zone) (string, error) {
	region, err := zone.Region()
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Validate credentials with `scw iam ssh-key list` using the same access/secret keys kops uses.
Check the IAM policy/applications permissions for the principal: it needs iam_ssh_keys list rights.
Confirm the project ID matches the project holding the cluster SSH keys.
If the IAM API returns 429/5xx, retry with backoff after checking Scaleway status.

Defensive patterns

Strategy: try-catch

Validate before calling

// preflight: can this principal list SSH keys?
import "github.com/scaleway/scaleway-sdk-go/services/iam"
api := iam.NewAPI(client)
if _, err := api.ListSSHKeys(&iam.ListSSHKeysRequest{PageSize: scw.Uint32Ptr(1)}); err != nil {
  return fmt.Errorf("iam ssh-key list preflight failed: %w", err)
}

Try / catch

if err := kopsValidateCluster(); err != nil {
  var scwErr *scw.Error
  if errors.As(err, &scwErr) && scwErr.StatusCode == 403 {
    // fix IAM policy before retrying
  }
  return err
}

Prevention

Grant the kops principal explicit iam_ssh_keys list permission.
Rotate credentials centrally and update kops env/config immediately.
Use a dedicated IAM application/policy for kops with least privilege including IAM read.

When it happens

Trigger: iam.API.ListSSHKeys failure: invalid/expired IAM credentials, IAM policy denying ssh_keys list permission, project ID mismatch, network error, or Scaleway IAM API outage/rate limit.

Common situations: Service account token or secret key rotated without updating kops config; IAM policy scoped too narrowly for the kops principal; transient IAM API outage during cluster validation.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/951e82b60bb925b6. Report an issue: GitHub.