aws / aws/eks-anywhere

Unable to change the SSH keys after cluster provision

Open
#10,419 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What happened**:
The issue occurred because we lost the SSH key that was originally used for cluster provisioning.

**What you expected to happen**:
I updated the SSH keys on the CAPI side, and the swap was successful. However, when I try to initiate a cluster upgrade with EKS-A, it treats the SSH key as immutable and continues to enforce the old key. During the upgrade, EKS-A still uses the old SSH key. I expected the cluster to use the new key, but EKS-A appears to block this change.

**How to reproduce it (as minimally and precisely as possible)**:
- Provision the cluster with SSH key A
- Override the cluster to use SSH key B through CAPI
- Attempt to upgrade the cluster with EKS-A using SSH key B → this is rejected, and if we use SSH key A, the upgrade proceeds but continues to use SSH key A

**Anything else we need to know?**:

**Environment**:
- EKS Anywhere Release: v0.20.11
- EKS Distro Release:

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the SSH key A to B change and upgrade flow described for EKS Anywhere v0.20.11, comparing the CAPI override with the key used during the upgrade. Done means an upgrade accepts the replacement key and no longer enforces or uses the original key.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.