{"record":{"id":"6b14ed17f5d0c976","repo":"k3s-io/k3s","slug":"service-s-is-not-recognized","errorCode":null,"errorMessage":"service %s is not recognized","messagePattern":"service (.+?) is not recognized","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cli/cert/cert.go","lineNumber":359,"sourceCode":"\tfor _, files := range fileMap {\n\t\tfor _, file := range files {\n\t\t\tif strings.HasPrefix(file, agentDataDir) {\n\t\t\t\tcert := filepath.Base(file)\n\t\t\t\ttlsBackupCert := filepath.Join(tlsBackupDir, cert)\n\t\t\t\tif err := util.CopyFile(file, tlsBackupCert, true); err != nil {\n\t\t\t\t\treturn \"\", err\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn tlsBackupDir, nil\n}\n\nfunc validateCertConfig() error {\n\tfor _, s := range cmds.ServicesList.Value() {\n\t\tif !services.IsValid(s) {\n\t\t\treturn errors.New(\"service \" + s + \" is not recognized\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc RotateCA(app *cli.Context) error {\n\tif err := cmds.InitLogging(); err != nil {\n\t\treturn err\n\t}\n\treturn rotateCA(app, &cmds.ServerConfig, &cmds.CertRotateCAConfig)\n}\n\nfunc rotateCA(app *cli.Context, cfg *cmds.Server, sync *cmds.CertRotateCA) error {\n\tvar serverConfig server.Config\n\n\t_, err := commandSetup(app, cfg, &serverConfig)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":341,"sourceCodeEnd":377,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/cli/cert/cert.go#L341-L377","documentation":"validateCertConfig runs for `k3s cert` subcommands (rotate/list) and checks every entry of --service against the fixed set of cert-managed services: agent-side kube-proxy, kubelet, <program>-controller; server-side api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, <program>-server (e.g. k3s-server). Any other string — including typos or internal names like certificate-authority — is rejected.","triggerScenarios":"k3s cert rotate --service=kube-apiserver (wrong name; valid is api-server); --service=certificate-authority (CA rotation is handled by a separate rotate-ca flow, not --service); arbitrary strings not in services.All.","commonSituations":"Admins guessing Kubernetes component names instead of k3s service names; scripts written against other distributions; attempting CA rotation through the wrong flag.","solutions":["Use a valid service name: one of api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, kube-proxy, kubelet, k3s-server, k3s-controller","For CA/certificate-authority rotation use the dedicated `k3s certificate rotate-ca` command instead of --service","List what the flags accept via k3s cert rotate --help before scripting"],"exampleFix":"# before\nk3s cert rotate --service kube-apiserver  # -> service kube-apiserver is not recognized\n\n# after\nk3s cert rotate --service api-server","handlingStrategy":"validation","validationCode":"valid := map[string]bool{}\nfor _, s := range services.All { valid[s] = true } // api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, kube-proxy, kubelet, <prog>-server, <prog>-controller\nfor _, s := range requestedServices {\n    if !valid[s] { return fmt.Errorf(\"unknown service %q; valid: %v\", s, services.All) }\n}","typeGuard":"func isValidService(svc string, all []string) bool {\n    for _, s := range all { if svc == s { return true } }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Script cert rotation against services.All rather than hard-coded names","Use `k3s cert rotate --help` output as the source of valid names in automation","Remember CA rotation goes through `k3s certificate rotate-ca`, not --service"],"tags":["certificates","cli","tls","validation","rotation"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}