diff --git a/e2e/docker-compose.yml b/e2e/docker-compose.yml
index 049801a4..e738b498 100644
--- a/e2e/docker-compose.yml
+++ b/e2e/docker-compose.yml
@@ -55,7 +55,7 @@ services:
     #   - default
     command: 
       - bash
-      - -c 
+      - -cx 
       - |
         (kind get kubeconfig -q -n sshpipertest || kind create cluster -n sshpipertest)
         docker network connect kind $$(hostname) # self contain
@@ -63,8 +63,9 @@ services:
         kind export kubeconfig -n sshpipertest --internal
         kind load docker-image -n sshpipertest e2e_piper-imageonly 
         kubectl wait --for=condition=ready pod -A --all --timeout=2m
-        kubectl delete -f /kubernetes/crd.yaml --force
-        kubectl delete -f /kubernetes/workload.yaml --force
+        kubectl delete -f /kubernetes/crd.yaml --force --ignore-not-found
+        kubectl delete -f /kubernetes/workload.yaml --force --ignore-not-found
+        set -e
         kubectl wait --for=delete pod --all --timeout=2m # ensure no leftover
         kubectl apply -f /kubernetes/crd.yaml
         kubectl apply -f /kubernetes/workload.yaml
diff --git a/e2e/k8sworkload.yaml b/e2e/k8sworkload.yaml
index c6e34dea..45251a0c 100644
--- a/e2e/k8sworkload.yaml
+++ b/e2e/k8sworkload.yaml
@@ -131,6 +131,9 @@ apiVersion: v1
 data:
   custom_field: |
     LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEVVJreDk5dWF3MUtkZHJhWmNMcEI1a2ZNcld3dlV6MmZQT29BckxjcHo5UUFBQUpDK2owK1N2bzlQCmtnQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRFVSa3g5OXVhdzFLZGRyYVpjTHBCNWtmTXJXd3ZVejJmUE9vQXJMY3B6OVEKQUFBRURjUWdkaDJ6MnIvNmJscTB6aUoxbDZzNklBWDhDKzlRSGZBSDkzMWNITk85UkdUSDMyNXJEVXAxMnRwbHd1a0htUgo4eXRiQzlUUFo4ODZnQ3N0eW5QMUFBQUFEV0p2YkdsaGJrQjFZblZ1ZEhVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
+  # echo -n 'notakey' | base64
+  ssh-privatekey: |
+    bm90YWtleSAtbgo=
 kind: Secret
 metadata:
   name: host-publickey-key-custom-field
diff --git a/plugin/kubernetes/kubernetes.go b/plugin/kubernetes/kubernetes.go
index a934a939..bc290a7f 100644
--- a/plugin/kubernetes/kubernetes.go
+++ b/plugin/kubernetes/kubernetes.go
@@ -158,7 +158,7 @@ func (p *plugin) createUpstream(conn libplugin.ConnMetadata, pipe *piperv1beta1.
 		var publicKey []byte
 		var privateKey []byte
 
-		for _, k := range []string{"ssh-privatekey", "privatekey", anno["privatekey_field_name"]} {
+		for _, k := range []string{anno["privatekey_field_name"], "ssh-privatekey", "privatekey"} {
 			data := secret.Data[k]
 			if data != nil {
 				log.Debugf("found private key in secret %v/%v", to.PrivateKeySecret.Name, k)
@@ -167,7 +167,7 @@ func (p *plugin) createUpstream(conn libplugin.ConnMetadata, pipe *piperv1beta1.
 			}
 		}
 
-		for _, k := range []string{"ssh-publickey", "publickey", anno["publickey_field_name"]} {
+		for _, k := range []string{anno["publickey_field_name"], "ssh-publickey", "publickey"} {
 			data := secret.Data[k]
 			if data != nil {
 				log.Debugf("found publickey key in secret %v/%v", to.PrivateKeySecret.Name, k)
@@ -189,7 +189,7 @@ func (p *plugin) createUpstream(conn libplugin.ConnMetadata, pipe *piperv1beta1.
 		}
 
 		anno := pipe.GetAnnotations()
-		for _, k := range []string{"password", anno["password_field_name"]} {
+		for _, k := range []string{anno["password_field_name"], "password"} {
 			data := secret.Data[k]
 			if data != nil {
 				log.Debugf("found password in secret %v/%v", to.PasswordSecret.Name, k)