{"record":{"id":"2627eafc3f1ed560","repo":"kubernetes/kops","slug":"api-version-q-is-not-supported","errorCode":null,"errorMessage":"api-version %q is not supported","messagePattern":"api-version %q is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/helpers/kubectl_auth.go","lineNumber":109,"sourceCode":"func RunKubectlAuthHelper(ctx context.Context, f *util.Factory, out io.Writer, options *HelperKubectlAuthOptions) error {\n\tif options.ClusterName == \"\" {\n\t\treturn fmt.Errorf(\"ClusterName is required\")\n\t}\n\n\texecCredential := &ExecCredential{\n\t\tKind: \"ExecCredential\",\n\t}\n\n\tswitch options.APIVersion {\n\tcase \"\":\n\t\treturn fmt.Errorf(\"api-version must be specified\")\n\tcase \"v1alpha1\":\n\t\texecCredential.APIVersion = \"client.authentication.k8s.io/v1alpha1\"\n\tcase \"v1beta1\":\n\t\texecCredential.APIVersion = \"client.authentication.k8s.io/v1beta1\"\n\n\tdefault:\n\t\treturn fmt.Errorf(\"api-version %q is not supported\", options.APIVersion)\n\t}\n\n\tcacheFilePath := cacheFilePath(f.KopsStateStore(), options.ClusterName)\n\tcached, err := loadCachedExecCredential(cacheFilePath)\n\tif err != nil {\n\t\tklog.Infof(\"cached credential %q was not valid: %v\", cacheFilePath, err)\n\t\tcached = nil\n\t}\n\n\tif cached != nil && cached.APIVersion != execCredential.APIVersion {\n\t\tklog.Infof(\"cached credential had wrong api version\")\n\t\tcached = nil\n\t}\n\n\tisCached := false\n\tif cached != nil {\n\t\texecCredential = cached\n\t\tisCached = true","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/helpers/kubectl_auth.go#L91-L127","documentation":"Only client.authentication.k8s.io v1alpha1 and v1beta1 are accepted by this helper; any other --api-version value hits the default branch and returns this error. kOps validates strictly rather than passing the version through, because the emitted ExecCredential.apiVersion must match a schema kubectl understands.","triggerScenarios":"Passing --api-version with a value like v1, v1beta2, or client.authentication.k8s.io/v1beta1 to kubectl-auth, or setting options.APIVersion to any string other than \"v1alpha1\"/\"v1beta1\" before calling RunKubectlAuthHelper.","commonSituations":"Newer kubectl versions requesting client.authentication.k8s.io/v1 (not supported by this kOps version); guessing flag values from kubectl docs rather than kOps docs; copying an apiVersion string including the group prefix.","solutions":["Use --api-version v1beta1 (the default) or v1alpha1.","Upgrade kOps to a version that supports the apiVersion your kubectl requests, or pin kubectl's exec plugin version via user.exec in the kubeconfig.","Check kubectl's client.authentication.k8s.io requested version and match it exactly to v1alpha1 or v1beta1."],"exampleFix":"// before\nargs: [\"helpers\", \"kubectl-auth\", \"--api-version\", \"v1\"]\n// after\nargs: [\"helpers\", \"kubectl-auth\", \"--api-version\", \"v1beta1\"]","handlingStrategy":"validation","validationCode":"func validAPIVersion(v string) bool {\n    return v == \"v1alpha1\" || v == \"v1beta1\"\n}\nif !validAPIVersion(opts.APIVersion) {\n    return fmt.Errorf(\"unsupported api-version %q; use v1alpha1 or v1beta1\", opts.APIVersion)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use v1alpha1 or v1beta1 for --api-version.","Check which client.authentication.k8s.io version your kubectl requests before configuring the plugin.","Upgrade kOps if you need newer exec-credential API versions."],"tags":["cli","api-version","validation"],"backgroundTag":"api-version-unsupported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}