{"record":{"id":"5e5c487b4c416e0e","repo":"kubernetes/kops","slug":"cannot-specify-cert-with-all","errorCode":null,"errorMessage":"cannot specify --cert with \"all\"","messagePattern":"cannot specify --cert with \"all\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":118,"sourceCode":"\t\t\toptions.ClusterName = rootCommand.ClusterName(true)\n\n\t\t\tif options.ClusterName == \"\" {\n\t\t\t\treturn fmt.Errorf(\"--name is required\")\n\t\t\t}\n\n\t\t\tif len(args) == 0 {\n\t\t\t\treturn fmt.Errorf(\"must specify name of keyset to add keypair to\")\n\t\t\t}\n\n\t\t\toptions.Keyset = args[0]\n\n\t\t\tif len(args) != 1 {\n\t\t\t\treturn fmt.Errorf(\"can only add to one keyset at a time\")\n\t\t\t}\n\n\t\t\tif options.Keyset == \"all\" {\n\t\t\t\tif options.CertPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --cert with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.PrivateKeyPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --key with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.Primary {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --primary with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\t\t\treturn completeCreateKeypair(cmd.Context(), f, options, args, toComplete)\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunCreateKeypair(cmd.Context(), f, out, options)\n\t\t},\n\t}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L100-L136","documentation":"The special keyset name \"all\" regenerates every keyset, but the command also supports supplying an existing certificate via --cert. These modes are mutually exclusive — you cannot both rotate everything and inject a specific certificate — so the validator rejects the combination upfront.","triggerScenarios":"Running `kops create keypair --name <cluster> --cert /path/to/cert.pem all` (i.e. keyset \"all\" combined with --cert).","commonSituations":"Scripting a bulk rotation while leftover --cert/--key/--primary flags remain set from a previous invocation; misunderstanding \"all\" as a wildcard that also accepts per-keyset options.","solutions":["Remove the --cert flag when using the \"all\" keyset","Target the specific keyset instead: `kops create keypair --name <cluster> --cert cert.pem <keyset>`","Review the command in scripts so flags from a bulk-rotation path don't leak into a specific-keyset path (or vice versa)"],"exampleFix":"// before\nkops create keypair --name c.k8s.local --cert ca.crt all\n// after\nkops create keypair --name c.k8s.local --cert ca.crt ca\n// or bulk rotation without --cert:\nkops create keypair --name c.k8s.local all","handlingStrategy":"validation","validationCode":"if [ \"$KEYSET\" = \"all\" ] && [ -n \"$CERT_PATH\" ]; then echo \"--cert cannot be used with keyset 'all'\" >&2; exit 2; fi","typeGuard":"func canUseAllKeyset(certPath, keyPath string, primary bool) bool { return certPath == \"\" && keyPath == \"\" && !primary }","tryCatchPattern":null,"preventionTips":["Keep bulk-rotation (all) and single-keyset (--cert/--key/--primary) invocations in separate code paths","Reset flag variables between command invocations in scripts","Review flag combinations before running create keypair"],"tags":["cli","flags","validation"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}