{"record":{"id":"67bf06ca27b85764","repo":"kubernetes/kops","slug":"unknown-authorization-mode-q","errorCode":null,"errorMessage":"unknown authorization mode %q","messagePattern":"unknown authorization mode %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":271,"sourceCode":"\t\t}\n\t}\n\n\tcluster.Spec.ConfigStore = api.ConfigStoreSpec{\n\t\tBase: opt.ConfigBase,\n\t}\n\tconfigBase, err := clientset.ConfigBaseFor(cluster)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building ConfigBase for cluster: %v\", err)\n\t}\n\tcluster.Spec.ConfigStore.Base = configBase.Path()\n\n\tcluster.Spec.Authorization = &api.AuthorizationSpec{}\n\tif strings.EqualFold(opt.Authorization, AuthorizationFlagAlwaysAllow) {\n\t\tcluster.Spec.Authorization.AlwaysAllow = &api.AlwaysAllowAuthorizationSpec{}\n\t} else if opt.Authorization == \"\" || strings.EqualFold(opt.Authorization, AuthorizationFlagRBAC) {\n\t\tcluster.Spec.Authorization.RBAC = &api.RBACAuthorizationSpec{}\n\t} else {\n\t\treturn nil, fmt.Errorf(\"unknown authorization mode %q\", opt.Authorization)\n\t}\n\n\tcluster.Spec.IAM = &api.IAMSpec{\n\t\tAllowContainerRegistry: true,\n\t}\n\tcluster.Spec.Kubelet = &api.KubeletConfigSpec{\n\t\tAnonymousAuth: new(false),\n\t}\n\n\tif len(opt.KubernetesFeatureGates) > 0 {\n\t\tcluster.Spec.Kubelet.FeatureGates = make(map[string]string)\n\t\tcluster.Spec.KubeAPIServer = &api.KubeAPIServerConfig{\n\t\t\tFeatureGates: make(map[string]string),\n\t\t}\n\t\tcluster.Spec.KubeControllerManager = &api.KubeControllerManagerConfig{\n\t\t\tFeatureGates: make(map[string]string),\n\t\t}\n\t\tcluster.Spec.KubeProxy = &api.KubeProxyConfig{","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L253-L289","documentation":"NewCluster only accepts authorization modes 'AlwaysAllow' (AuthorizationFlagAlwaysAllow) and 'RBAC' (AuthorizationFlagRBAC, also the empty-string default). Any other value for opt.Authorization is rejected with this error.","triggerScenarios":"`kops create cluster --authorization <mode>` where mode is anything other than AlwaysAllow or RBAC (case-insensitive), e.g. legacy 'Abac', 'AlwaysAllowAll', or misspellings.","commonSituations":"Copying flags from old kOps documentation (ABAC was removed long ago); typos like 'rbca'; passing a value with stray whitespace that EqualFold does not match.","solutions":["Use --authorization rbac (recommended) or --authorization alwaysallow","Omit the flag entirely — empty defaults to RBAC","Trim whitespace/typos from the flag value"],"exampleFix":"// before\nkops create cluster --authorization abac --name c.example.com\n// after\nkops create cluster --authorization rbac --name c.example.com","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"\": true, \"rbac\": true, \"alwaysallow\": true}\nif !allowed[strings.ToLower(strings.TrimSpace(opt.Authorization))] {\n    return fmt.Errorf(\"--authorization must be rbac or alwaysallow\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only pass rbac or alwaysallow","Omit the flag to accept the RBAC default","Avoid legacy modes like ABAC from old docs"],"tags":["authorization","rbac","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}