{"record":{"id":"58b9a9517f3e52c6","repo":"kubernetes/kops","slug":"cannot-specify-primary-with-all","errorCode":null,"errorMessage":"cannot specify --primary with \"all\"","messagePattern":"cannot specify --primary with \"all\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":124,"sourceCode":"\t\t\tif len(args) == 0 {\n\t\t\t\treturn fmt.Errorf(\"must specify name of keyset to add keypair to\")\n\t\t\t}\n\n\t\t\toptions.Keyset = args[0]\n\n\t\t\tif len(args) != 1 {\n\t\t\t\treturn fmt.Errorf(\"can only add to one keyset at a time\")\n\t\t\t}\n\n\t\t\tif options.Keyset == \"all\" {\n\t\t\t\tif options.CertPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --cert with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.PrivateKeyPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --key with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.Primary {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --primary with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\t\t\treturn completeCreateKeypair(cmd.Context(), f, options, args, toComplete)\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunCreateKeypair(cmd.Context(), f, out, options)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVar(&options.CertPath, \"cert\", options.CertPath, \"Path to CA certificate\")\n\tcmd.Flags().StringVar(&options.PrivateKeyPath, \"key\", options.PrivateKeyPath, \"Path to CA private key\")\n\tcmd.Flags().BoolVar(&options.Primary, \"primary\", options.Primary, \"Make the keypair the one used to issue certificates\")\n\n\treturn cmd","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L106-L142","documentation":"Same family as the --key / --cert rejections with `--keyset all`: `--primary` designates the new keypair as primary for a single keyset, which is meaningless (and ambiguous) when rotating `all` keysets at once. The Args validator rejects the combination up front.","triggerScenarios":"Running `kops create keypair <cluster> --keyset all --primary` — options.Keyset == \"all\" and options.Primary == true in the Args validator (cmd/kops/create_keypair.go:124).","commonSituations":"Operators who just rotated with `--keyset all` and want the new keys to be primary, not realizing --primary requires a specific keyset; scripted follow-up commands appending --primary unconditionally.","solutions":["Remove --primary when using --keyset all.","If primary designation is required, run per keyset: `kops create keypair <cluster> --keyset <name> --primary`.","Check `kops get keypairs` afterwards to confirm which key became primary."],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset all --primary\n// after\nkops create keypair cluster.k8s.local --keyset ca --primary","handlingStrategy":"validation","validationCode":"if [[ \"$KEYSET\" == \"all\" && \"$PRIMARY\" == \"true\" ]]; then echo \"--primary cannot be combined with --keyset all\"; exit 1; fi\nkops create keypair \"$CLUSTER\" --keyset \"$KEYSET\" $([[ \"$PRIMARY\" == \"true\" && \"$KEYSET\" != \"all\" ]] && echo --primary)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat --keyset all as a bulk operation that disallows per-keyset qualifiers.","Designate primary keys only in per-keyset invocations.","Verify primary status afterwards with `kops get keypairs` instead of assuming."],"tags":["cli","flag-validation","keypair","kops"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}