{"record":{"id":"b0f7c8aef381ca90","repo":"kubernetes/kops","slug":"unrecognized-key-q-in-token-q","errorCode":null,"errorMessage":"unrecognized key %q in token %q","messagePattern":"unrecognized key %q in token %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/keypair.go","lineNumber":341,"sourceCode":"\tname := new(pkix.Name)\n\n\ttokens := strings.Split(s, \",\")\n\tfor _, token := range tokens {\n\t\ttoken = strings.TrimSpace(token)\n\t\tkv := strings.SplitN(token, \"=\", 2)\n\t\tif len(kv) != 2 {\n\t\t\treturn nil, fmt.Errorf(\"unrecognized token (expected k=v): %q\", token)\n\t\t}\n\t\tk := strings.ToLower(kv[0])\n\t\tv := kv[1]\n\n\t\tswitch k {\n\t\tcase \"cn\":\n\t\t\tname.CommonName = v\n\t\tcase \"o\":\n\t\t\tname.Organization = append(name.Organization, v)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unrecognized key %q in token %q\", k, token)\n\t\t}\n\t}\n\n\treturn name, nil\n}\n\nfunc (e *Keypair) ensureResources() {\n\tif e.certificates == nil {\n\t\te.certificates = &fi.CloudupTaskDependentResource{\n\t\t\tResource: fi.NewStringResource(\"<< TO BE GENERATED >>\\n\"),\n\t\t\tTask:     e,\n\t\t}\n\t\te.keyset = &fi.Keyset{\n\t\t\tPrimary: &fi.KeysetItem{\n\t\t\t\tId: \"<< TO BE GENERATED >>\",\n\t\t\t},\n\t\t}\n\t}","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/keypair.go#L323-L359","documentation":"Thrown by parsePkixName while parsing a comma-separated pkix name string (e.g. \"O=kOps,CN=kops-controller\"): a token parsed as k=v used a key other than the supported \"cn\" (CommonName) or \"o\" (Organization). Keys are lowercased first, so this fires for misspelled or unsupported attributes like \"ou=\", \"email=\", or \"c=\".","triggerScenarios":"A keypair subject contains a supported k=v token whose key is not \"cn\" or \"o\", e.g. \"CN=api,OU=Platform\".","commonSituations":"Users copying standard OpenSSL/LDAP distinguished names (with OU, C, DC, etc.) into kops keypair subject config.","solutions":["Remove or rewrite unsupported DN components; keep only CN and O in the subject.","Map desired organizational info into the O field (multiple O tokens are allowed and appended).","If extra components are genuinely needed, upstream change to parsePkixName is required."],"exampleFix":"// before\nsubject: \"CN=etcd,O=Example,OU=Platform\"\n// after\nsubject: \"CN=etcd,O=Example,O=Platform\"","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"cn\": true, \"o\": true}\nfor _, tok := range strings.Split(subject, \",\") {\n    kv := strings.SplitN(strings.TrimSpace(tok), \"=\", 2)\n    if len(kv) == 2 && !allowed[strings.ToLower(kv[0])] {\n        return fmt.Errorf(\"unsupported DN key %q\", kv[0])\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil { return fmt.Errorf(\"subject %q: only CN and O are supported: %w\", s, err) }","preventionTips":["Only use CN and O components in keypair subjects","Drop OU/C/ST/DC components from LDAP-style DNs","Encode extra hierarchy via multiple O tokens"],"tags":["parsing","pki","config"],"backgroundTag":"pkix-name-parse-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}