{"record":{"id":"8a111f44f693d853","repo":"kubernetes/kops","slug":"key-name-not-enabled","errorCode":null,"errorMessage":"key name not enabled","messagePattern":"key name not enabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/server.go","lineNumber":311,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"decoding pem public key\")\n\t}\n\tif block.Type != \"RSA PUBLIC KEY\" {\n\t\treturn \"\", fmt.Errorf(\"unexpected key type %q\", block.Type)\n\t}\n\tkey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing key: %v\", err)\n\t}\n\n\tissueReq := &pki.IssueCertRequest{\n\t\tSigner:    fi.CertificateIDCA,\n\t\tType:      \"client\",\n\t\tPublicKey: key,\n\t\tValidity:  time.Hour * time.Duration(validHours),\n\t}\n\n\tif !s.certNames.Has(name) {\n\t\treturn \"\", fmt.Errorf(\"key name not enabled\")\n\t}\n\tswitch name {\n\tcase \"etcd-client-cilium\":\n\t\tissueReq.Signer = \"etcd-clients-ca-cilium\"\n\t\tissueReq.Subject = pkix.Name{\n\t\t\tCommonName: \"cilium\",\n\t\t}\n\tcase \"kubelet\":\n\t\tissueReq.Subject = pkix.Name{\n\t\t\tCommonName:   fmt.Sprintf(\"system:node:%s\", id.NodeName),\n\t\t\tOrganization: []string{rbac.NodesGroup},\n\t\t}\n\tcase \"kubelet-server\":\n\t\tissueReq.Subject = pkix.Name{\n\t\t\tCommonName: id.NodeName,\n\t\t}\n\t\tissueReq.AlternateNames = id.CertificateNames\n\t\tissueReq.Type = \"server\"","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/server.go#L293-L329","documentation":"The controller only issues certificates for key names explicitly enabled on the server (s.certNames, configured per-controller via certNames flag). If the requested name is not in that allowlist, issueCert rejects it with \"key name not enabled\".","triggerScenarios":"A node calls bootstrap/issueCert with a name (e.g. etcd-client-cilium, kube-router, kubelet) that the controller instance was not started with in its --cert-names list.","commonSituations":"Running kops-controller without the full set of --cert-names flags for the cluster's features (Cilium, kube-router enabled in the cluster spec but not the controller), or misconfigured controller Deployment manifest after cluster feature changes.","solutions":["Add the missing name to the kops-controller --cert-names flag in its Deployment manifest and restart the pod","Re-run `kops update cluster` so the controller manifest is regenerated with the correct cert names for the cluster spec","Check the cluster spec for enabled features (networking plugin) and ensure the controller config matches"],"exampleFix":"// before (Deployment args)\nargs: [\"--server\", \"--cloud=aws\"]\n// after\nargs: [\"--server\", \"--cloud=aws\", \"--cert-names=kubelet,etcd-client-cilium,kube-router\"]","handlingStrategy":"validation","validationCode":"// before calling issueCert, check the server allowlist\nif !allowedCertNames.Has(requestedName) {\n    return fmt.Errorf(\"cert name %q not in controller --cert-names\", requestedName)\n}","typeGuard":"func isCertNameEnabled(name string, certNames sets.Set[string]) bool {\n    return certNames.Has(name)\n}","tryCatchPattern":"_, err := client.Bootstrap(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"key name not enabled\") {\n    log.Printf(\"controller lacks --cert-names entry for %q; fix Deployment args\", name)\n}","preventionTips":["Keep --cert-names in the controller Deployment in sync with cluster networking features (Cilium, kube-router)","Regenerate controller manifests via `kops update cluster` rather than hand-editing","After enabling a new networking plugin, update controller flags before node rollovers"],"tags":["certificates","configuration","bootstrap","allowlist"],"backgroundTag":"feature-not-enabled","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}