{"record":{"id":"3c45842d3547923f","repo":"kubernetes/kops","slug":"cannot-use-both-admin-and-user","errorCode":null,"errorMessage":"cannot use both --admin and --user","messagePattern":"cannot use both --admin and --user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/export_kubeconfig.go","lineNumber":74,"sourceCode":"type ExportKubeconfigOptions struct {\n\tClusterName    string\n\tKubeConfigPath string\n\tall            bool\n\tkubeconfig.CreateKubecfgOptions\n}\n\nfunc NewCmdExportKubeconfig(f *util.Factory, out io.Writer) *cobra.Command {\n\toptions := &ExportKubeconfigOptions{}\n\n\tcmd := &cobra.Command{\n\t\tUse:     \"kubeconfig [CLUSTER | --all]\",\n\t\tAliases: []string{\"kubecfg\"},\n\t\tShort:   exportKubeconfigShort,\n\t\tLong:    exportKubeconfigLong,\n\t\tExample: exportKubeconfigExample,\n\t\tArgs: func(cmd *cobra.Command, args []string) error {\n\t\t\tif options.Admin != 0 && options.User != \"\" {\n\t\t\t\treturn fmt.Errorf(\"cannot use both --admin and --user\")\n\t\t\t}\n\t\t\tif options.all {\n\t\t\t\tif len(args) != 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cannot use both --all flag and positional arguments\")\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t} else {\n\t\t\t\treturn rootCommand.clusterNameArgs(&options.ClusterName)(cmd, args)\n\t\t\t}\n\t\t},\n\t\tValidArgsFunction: commandutils.CompleteClusterName(f, true, false),\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunExportKubeconfig(cmd.Context(), f, out, options, args)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVar(&options.KubeConfigPath, \"kubeconfig\", options.KubeConfigPath, \"Filename of the kubeconfig to create\")\n\tcmd.Flags().BoolVar(&options.all, \"all\", options.all, \"Export all clusters from the kOps state store\")","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/export_kubeconfig.go#L56-L92","documentation":"The `kops export kubeconfig` command's Args validator rejects combining --admin (request admin credentials with a lifetime) and --user (export credentials for a specific regular user). The two credential modes are mutually exclusive, so passing both is a usage error returned before any cluster interaction.","triggerScenarios":"Running `kops export kubeconfig --admin --user janes` or with --admin=<duration> together with --user; options.Admin != 0 and options.User != \"\" both set.","commonSituations":"Script templating that appends both flags; copying an example command and adding a second credential flag; aliases/scripts with baked-in --admin while user adds --user.","solutions":["Drop --admin if you want a regular user's credentials: kops export kubeconfig --user <name>","Drop --user if you want admin/cluster credentials: kops export kubeconfig --admin[=duration]","Fix the calling script/alias so only one credential flag is passed"],"exampleFix":"// before\nkops export kubeconfig mycluster --admin --user janes\n// after\nkops export kubeconfig mycluster --user janes","handlingStrategy":"validation","validationCode":"adminSet := flags.Changed(\"admin\") || opts.Admin != 0\nuserSet := opts.User != \"\"\nif adminSet && userSet {\n    return errors.New(\"cannot use both --admin and --user\")\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"kops\", args...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"cannot use both --admin and --user\") {\n    // strip one credential flag and retry\n}","preventionTips":["Pass either --admin or --user, never both","Audit scripts/aliases that inject --admin before adding --user","Check `kops export kubeconfig --help` for flag semantics before scripting"],"tags":["cli","flags","kubeconfig"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}