{"record":{"id":"79689180ab68e3ef","repo":"kubernetes/kops","slug":"cannot-use-both-admin-and-user-796891","errorCode":null,"errorMessage":"cannot use both --admin and --user","messagePattern":"cannot use both --admin and --user","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/update_cluster.go","lineNumber":229,"sourceCode":"\tCluster *kops.Cluster\n}\n\nfunc RunCoreUpdateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *CoreUpdateClusterOptions) (*UpdateClusterResults, error) {\n\topt := &UpdateClusterOptions{}\n\topt.CoreUpdateClusterOptions = *c\n\topt.Reconcile = false\n\topt.CreateKubecfgOptions.CreateKubecfg = false\n\treturn RunUpdateCluster(ctx, f, out, opt)\n}\n\nfunc RunUpdateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *UpdateClusterOptions) (*UpdateClusterResults, error) {\n\tresults := &UpdateClusterResults{}\n\n\tisDryrun := false\n\ttargetName := c.Target\n\n\tif c.Admin != 0 && c.User != \"\" {\n\t\treturn nil, fmt.Errorf(\"cannot use both --admin and --user\")\n\t}\n\n\tif c.Admin != 0 && !c.CreateKubecfg {\n\t\tklog.Info(\"--admin implies --create-kube-config\")\n\t\tc.CreateKubecfg = true\n\t}\n\n\tif c.User != \"\" && !c.CreateKubecfg {\n\t\tklog.Info(\"--user implies --create-kube-config\")\n\t\tc.CreateKubecfg = true\n\t}\n\n\tif c.Internal && !c.CreateKubecfg {\n\t\tklog.Info(\"--internal implies --create-kube-config\")\n\t\tc.CreateKubecfg = true\n\t}\n\n\t// direct requires --yes (others do not, because they don't do anything!)","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/update_cluster.go#L211-L247","documentation":"`kops update cluster` rejects mutually exclusive authentication-related flags: --admin (create admin kubeconfig with a given lifetime) and --user (impersonate an existing user) cannot be combined. RunUpdateCluster returns this validation error before doing any cluster work.","triggerScenarios":"Invoking `kops update cluster ... --admin 87600h --user jdoe` (or --admin with any nonzero duration plus a non-empty --user). Both select the kubeconfig credential mode, so only one may be set.","commonSituations":"Script accumulated flags over time; copying an example command and appending --user to an existing --admin; converting a script from admin-kubeconfig mode to impersonation mode without removing --admin.","solutions":["Remove --admin if you want a kubeconfig that impersonates --user","Remove --user if you want an admin client certificate via --admin","Split the invocations: generate an admin kubeconfig and a user kubeconfig separately"],"exampleFix":"// before\nkops update cluster c.k8s.local --admin 87600h --user jdoe --yes\n// after\nkops update cluster c.k8s.local --user jdoe --yes","handlingStrategy":"validation","validationCode":"if (opts.Admin != 0) == (opts.User != \"\") && opts.Admin != 0 {\n\treturn errors.New(\"--admin and --user are mutually exclusive\")\n}\n_ = runUpdateCluster(opts)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep flag sets in scripts minimal — one credential mode per invocation","Lint shell scripts for the co-occurrence of --admin and --user","Document the chosen kubeconfig mode (admin cert vs impersonation) per environment"],"tags":["cli","flag-validation","kubeconfig"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}