{"record":{"id":"64c10929886f88e7","repo":"kubernetes/kops","slug":"cannot-specify-key-with-all","errorCode":null,"errorMessage":"cannot specify --key with \"all\"","messagePattern":"cannot specify --key with \"all\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_keypair.go","lineNumber":121,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"--name is required\")\n\t\t\t}\n\n\t\t\tif len(args) == 0 {\n\t\t\t\treturn fmt.Errorf(\"must specify name of keyset to add keypair to\")\n\t\t\t}\n\n\t\t\toptions.Keyset = args[0]\n\n\t\t\tif len(args) != 1 {\n\t\t\t\treturn fmt.Errorf(\"can only add to one keyset at a time\")\n\t\t\t}\n\n\t\t\tif options.Keyset == \"all\" {\n\t\t\t\tif options.CertPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --cert with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.PrivateKeyPath != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --key with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t\tif options.Primary {\n\t\t\t\t\treturn fmt.Errorf(\"cannot specify --primary with \\\"all\\\"\")\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\t\t\treturn completeCreateKeypair(cmd.Context(), f, options, args, toComplete)\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunCreateKeypair(cmd.Context(), f, out, options)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVar(&options.CertPath, \"cert\", options.CertPath, \"Path to CA certificate\")\n\tcmd.Flags().StringVar(&options.PrivateKeyPath, \"key\", options.PrivateKeyPath, \"Path to CA private key\")","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_keypair.go#L103-L139","documentation":"kops `create keypair` supports rotating a whole keyset or supplying a custom certificate/private key, but not both at once. When `--keyset all` is passed (meaning 'add a keypair to every rotatable keyset'), supplying `--key` is contradictory because a single private key cannot apply to all keysets. The cobra command's Args validator rejects the flag combination before any cluster work starts.","triggerScenarios":"Running `kops create keypair <cluster> --keyset all --key <path>` — i.e. options.Keyset == \"all\" and options.PrivateKeyPath != \"\" in the command's Args validation (cmd/kops/create_keypair.go:121).","commonSituations":"Operators automating CA rotation script `kops create keypair ... all` and paste in the same --key/--cert flags used for a single-keyset invocation; copy-paste from older runbooks targeting one keyset.","solutions":["Remove the --key flag when using --keyset all.","If you intended to add a key to one specific keyset, replace `all` with the keyset name (e.g. --keyset ca).","To provide keys for every keyset, run `kops create keypair` once per keyset with the appropriate --key."],"exampleFix":"// before\nkops create keypair cluster.k8s.local --keyset all --key /path/to/private.key\n// after\nkops create keypair cluster.k8s.local --keyset ca --key /path/to/private.key","handlingStrategy":"validation","validationCode":"if [[ \"$KEYSET\" == \"all\" && -n \"$KEY\" ]]; then echo \"--key cannot be combined with --keyset all\"; exit 1; fi\nkops create keypair \"$CLUSTER\" --keyset \"$KEYSET\" ${KEY:+--key \"$KEY\"}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never add --key/--cert/--primary to scripts that pass --keyset all.","Build CLI invocations from explicit flag variables so combinations are reviewable.","Shell-complete with `kops create keypair --help` to recall flag constraints before running."],"tags":["cli","flag-validation","keypair","kops"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}