Unable to change the SSH keys after cluster provision
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What happened**:
The issue occurred because we lost the SSH key that was originally used for cluster provisioning.
**What you expected to happen**:
I updated the SSH keys on the CAPI side, and the swap was successful. However, when I try to initiate a cluster upgrade with EKS-A, it treats the SSH key as immutable and continues to enforce the old key. During the upgrade, EKS-A still uses the old SSH key. I expected the cluster to use the new key, but EKS-A appears to block this change.
**How to reproduce it (as minimally and precisely as possible)**:
- Provision the cluster with SSH key A
- Override the cluster to use SSH key B through CAPI
- Attempt to upgrade the cluster with EKS-A using SSH key B → this is rejected, and if we use SSH key A, the upgrade proceeds but continues to use SSH key A
**Anything else we need to know?**:
**Environment**:
- EKS Anywhere Release: v0.20.11
- EKS Distro Release:
Contributor guide
Research direction
Start by reproducing the SSH key A to B change and upgrade flow described for EKS Anywhere v0.20.11, comparing the CAPI override with the key used during the upgrade. Done means an upgrade accepts the replacement key and no longer enforces or uses the original key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100