{"record":{"id":"581b2d38f1bcdfa0","repo":"kubernetes/kops","slug":"adding-keypair-to-q-is-not-supported","errorCode":null,"errorMessage":"adding keypair to %q is not supported","messagePattern":"adding keypair to %q is not supported","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":148,"sourceCode":"\t\tValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\t\t\treturn completeCreateKeypair(cmd.Context(), f, options, args, toComplete)\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunCreateKeypair(cmd.Context(), f, out, options)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVar(&options.CertPath, \"cert\", options.CertPath, \"Path to CA certificate\")\n\tcmd.Flags().StringVar(&options.PrivateKeyPath, \"key\", options.PrivateKeyPath, \"Path to CA private key\")\n\tcmd.Flags().BoolVar(&options.Primary, \"primary\", options.Primary, \"Make the keypair the one used to issue certificates\")\n\n\treturn cmd\n}\n\n// RunCreateKeypair adds a custom CA certificate and private key.\nfunc RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *CreateKeypairOptions) error {\n\tif !rotatableKeysetFilter(options.Keyset, nil) {\n\t\treturn fmt.Errorf(\"adding keypair to %q is not supported\", options.Keyset)\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting cluster: %q: %v\", options.ClusterName, err)\n\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L130-L166","documentation":"RunCreateKeypair only supports adding keypairs to keysets that pass rotatableKeysetFilter (the rotatable CA-style keysets such as \"ca\", \"service-account\", etc.). A keyset name outside that allowlist (e.g. \"all\" handled separately, or a non-rotatable keyset like \"apiserver-aggregator\") is rejected with this message.","triggerScenarios":"`kops create keypair <cluster> --keyset <name>` where <name> is not a rotatable keyset per rotatableKeysetFilter (cmd/kops/create_keypair.go:148).","commonSituations":"Typo in keyset name; attempting to inject a keypair into a keyset that kOps generates itself; targeting legacy/deprecated keysets after a cluster upgrade.","solutions":["Run `kops get keypairs` to list valid keysets and pick a rotatable one.","Correct the --keyset spelling (e.g. \"ca\", not \"certificate-authority\").","If the keyset genuinely should be rotatable, check the kOps version — rotatable keyset support was added incrementally; upgrade kOps."],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset apiserver\n// after\nkops create keypair cluster.k8s.local --keyset ca","handlingStrategy":"validation","validationCode":"ROTATABLE=\"^(all|ca|service-account)$\"\n[[ \"$KEYSET\" =~ $ROTATABLE ]] || { echo \"keyset '$KEYSET' is not rotatable\"; exit 1; }\nkops create keypair \"$CLUSTER\" --keyset \"$KEYSET\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["List actual keysets with `kops get keypairs` before scripting rotations.","Only use keyset names shown as rotatable in the kOps docs for your version.","Validate --keyset values against an allowlist in automation."],"tags":["cli","keypair","keyset","validation","kops"],"backgroundTag":"invalid-enum-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}