{"record":{"id":"05122addcaf09e40","repo":"kubernetes/kops","slug":"unrecognized-token-expected-k-v-q","errorCode":null,"errorMessage":"unrecognized token (expected k=v): %q","messagePattern":"unrecognized token \\(expected k=v\\): %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":330,"sourceCode":"\tkeyset.Primary = ki\n\n\terr = keystore.StoreKeyset(ctx, name, keyset)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn keyset, nil\n}\n\nfunc parsePkixName(s string) (*pkix.Name, error) {\n\tname := new(pkix.Name)\n\n\ttokens := strings.Split(s, \",\")\n\tfor _, token := range tokens {\n\t\ttoken = strings.TrimSpace(token)\n\t\tkv := strings.SplitN(token, \"=\", 2)\n\t\tif len(kv) != 2 {\n\t\t\treturn nil, fmt.Errorf(\"unrecognized token (expected k=v): %q\", token)\n\t\t}\n\t\tk := strings.ToLower(kv[0])\n\t\tv := kv[1]\n\n\t\tswitch k {\n\t\tcase \"cn\":\n\t\t\tname.CommonName = v\n\t\tcase \"o\":\n\t\t\tname.Organization = append(name.Organization, v)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unrecognized key %q in token %q\", k, token)\n\t\t}\n\t}\n\n\treturn name, nil\n}\n\nfunc (e *Keypair) ensureResources() {","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L312-L348","documentation":"parsePkixName parses a PKIX distinguished-name string (comma-separated k=v tokens) used for certificate subjects. If any comma-separated token does not contain an '=' sign, parsing fails with this error, aborting keypair Render.","triggerScenarios":"A keypair's Subject field (from cluster spec or task config) contains a comma-separated list where at least one element lacks '=', e.g. \"CN=api,O=Org,Example\".","commonSituations":"Hand-written cluster spec subject strings, copy-pasted DN strings from other tools using different formats (e.g. slash-separated '/CN=foo'), or empty extra tokens like a trailing comma producing an empty token without '='.","solutions":["Fix the subject string so every comma-separated token is key=value, e.g. \"CN=example.com,O=MyOrg\".","Only supported keys are cn and o — replace unsupported DN keys and check the sibling error for unrecognized keys.","Avoid trailing commas or whitespace-only tokens in the subject value."],"exampleFix":"// before\nsubject: \"CN=api.cluster.k8s.local,O=Example,\"\n// after\nsubject: \"CN=api.cluster.k8s.local,O=Example\"","handlingStrategy":"validation","validationCode":"for _, tok := range strings.Split(subject, \",\") {\n    tok = strings.TrimSpace(tok)\n    if tok != \"\" && !strings.Contains(tok, \"=\") {\n        return fmt.Errorf(\"bad DN token %q\", tok)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil { return fmt.Errorf(\"invalid subject %q: %w\", s, err) }","preventionTips":["Every DN token must be k=v; no trailing commas","Use slash-form OpenSSL DNs converted to comma form before putting them in the spec","Keep subjects limited to CN and O keys"],"tags":["parsing","pki","config"],"backgroundTag":"pkix-name-parse-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}