kubernetes/kops · error

Found multiple SSHKeys with Name %q

Error message

Found multiple SSHKeys with Name %q

What it means

If DescribeKeyPairs unexpectedly returns more than one key pair for the queried name, find aborts with "Found multiple SSHKeys with Name". EC2 normally enforces key-pair name uniqueness, so this indicates an API anomaly or a name-match behavior change.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sshkey.go:80

func (e *SSHKey) find(ctx context.Context, cloud awsup.AWSCloud) (*SSHKey, error) {
	request := &ec2.DescribeKeyPairsInput{
		KeyNames: []string{fi.ValueOf(e.Name)},
	}

	response, err := cloud.EC2().DescribeKeyPairs(ctx, request)
	if err != nil && awsup.AWSErrorCode(err) != "InvalidKeyPair.NotFound" {
		return nil, fmt.Errorf("error listing SSHKeys: %v", err)
	}

	if response == nil || len(response.KeyPairs) == 0 {
		if e.IsExistingKey() && *e.Name != "" {
			return nil, fmt.Errorf("unable to find specified SSH key %q", *e.Name)
		}
		return nil, nil
	}

	if len(response.KeyPairs) != 1 {
		return nil, fmt.Errorf("Found multiple SSHKeys with Name %q", *e.Name)
	}

	k := response.KeyPairs[0]
	actual := &SSHKey{
		ID:             k.KeyPairId,
		Name:           k.KeyName,
		KeyFingerprint: k.KeyFingerprint,
		Tags:           mapEC2TagsToMap(k.Tags),
		Shared:         e.Shared,
	}

	// Avoid spurious changes
	if k.KeyType == ec2types.KeyTypeEd25519 {
		// Trim the trailing "=" and prefix with "SHA256:" to match the output of "ssh-keygen -lf"
		fingerprint := fi.ValueOf(k.KeyFingerprint)
		fingerprint = strings.TrimRight(fingerprint, "=")
		fingerprint = fmt.Sprintf("SHA256:%s", fingerprint)
		actual.KeyFingerprint = new(fingerprint)

View on GitHub (pinned to 4c8573c808)

Solutions

1. List keys with aws ec2 describe-key-pairs and delete the duplicate.
2. Ensure only one kOps process applies at a time (avoid concurrent applies).
3. Re-run kops apply after cleanup; uniqueness should be restored.
4. If seen repeatedly in CI, serialize key import steps.

Example fix

// before
aws ec2 import-key-pair --key-name same-key &  # concurrent runs
// after
run kops apply sequentially / lock CI jobs with a mutex

out, _ := exec.Command("aws", "ec2", "describe-key-pairs", "--query", "KeyPairs").Output()
// check for duplicate names across the account before applying

if err != nil && strings.Contains(err.Error(), "Found multiple SSHKeys") {
    // fallback: clean duplicates out-of-band, then retry once
    cleanupDuplicateKeys(); return runKopsApply()
}

When it happens

Trigger: response.KeyPairs has length > 1 after a DescribeKeyPairs call filtered by KeyNames — only possible through EC2 API anomalies, eventual consistency during concurrent imports of the same name, or a mocked/test environment.

Common situations: Concurrent kOps runs importing the same key name simultaneously; stale/test double EC2 backends; cross-account aggregation bugs in tooling wrapping the API.

Related errors

• error listing SSHKeys: %v
• unable to find specified SSH key %q
• error creating SSHKey: %v
• DIGITALOCEAN_ACCESS_TOKEN is required
• timed out waiting for volume to detach

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f784bdb3b912245c. Report an issue: GitHub.