{"record":{"id":"9c2861ed1ddd240a","repo":"kubernetes/kops","slug":"promoting-keypairs-for-q-is-not-supported","errorCode":null,"errorMessage":"promoting keypairs for %q is not supported","messagePattern":"promoting keypairs for %q is not supported","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/promote_keypair.go","lineNumber":118,"sourceCode":"\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {\n\t\t\treturn completePromoteKeyset(cmd.Context(), f, options, args, toComplete)\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunPromoteKeypair(cmd.Context(), f, out, options)\n\t\t},\n\t}\n\n\treturn cmd\n}\n\n// RunPromoteKeypair promotes a keypair.\nfunc RunPromoteKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *PromoteKeypairOptions) error {\n\tif !rotatableKeysetFilter(options.Keyset, nil) {\n\t\treturn fmt.Errorf(\"promoting keypairs for %q is not supported\", options.Keyset)\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting cluster: %q: %v\", options.ClusterName, err)\n\t}\n\n\tclientSet, err := f.KopsClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting clientset: %v\", err)\n\t}\n\n\tkeyStore, err := clientSet.KeyStore(cluster)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting keystore: %v\", err)\n\t}\n\n\tif options.Keyset != \"all\" {","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/promote_keypair.go#L100-L136","documentation":"RunPromoteKeypair only supports keysets that are rotatable (those passing rotatableKeysetFilter, e.g. the well-known CAs and other rotatable keysets). Requesting promotion for any other keyset name is rejected before any cluster access.","triggerScenarios":"Running `kops promote keypair <keyset> --name <cluster>` with a keyset that is not in the rotatable set (e.g. a service-account signing keyset or an arbitrary/misspelled name).","commonSituations":"Typo in the keyset name; attempting to promote a keyset that kOps does not treat as rotatable; following older docs that referenced a non-rotatable keyset.","solutions":["Use a rotatable keyset such as kubernetes-ca or apiserver-aggregator-ca","Use `all` to promote every rotatable keyset at once","Run `kops get keypairs --name <cluster>` to list valid keysets and check spelling"],"exampleFix":"// before\nkops promote keypair service-account --name c\n// after\nkops promote keypair all --name c","handlingStrategy":"validation","validationCode":"case \"$KEYSET\" in\n  all|kubernetes-ca|apiserver-aggregator-ca) ;;\n  *) echo \"keyset '$KEYSET' is not rotatable\"; exit 1;;\nesac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["List keysets with `kops get keypairs` before promoting","Only use documented rotatable keysets","Check spelling of keyset names against kOps source (rotatableKeysetFilter)"],"tags":["cli","validation","keyset","keypair"],"backgroundTag":"unsupported-keyset","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}