{"record":{"id":"bd749ac643d12194","repo":"k3s-io/k3s","slug":"s-is-not-a-recognized-service","errorCode":null,"errorMessage":"%s is not a recognized service","messagePattern":"(.+?) is not a recognized service","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/util/services/services.go","lineNumber":147,"sourceCode":"\t\t\t\tfilepath.Join(agentDataDir, \"client-kube-proxy.key\"),\n\t\t\t}\n\t\tcase CertificateAuthority:\n\t\t\tfileMap[service] = []string{\n\t\t\t\tcontrolConfig.Runtime.ServerCA,\n\t\t\t\tcontrolConfig.Runtime.ServerCAKey,\n\t\t\t\tcontrolConfig.Runtime.ClientCA,\n\t\t\t\tcontrolConfig.Runtime.ClientCAKey,\n\t\t\t\tcontrolConfig.Runtime.RequestHeaderCA,\n\t\t\t\tcontrolConfig.Runtime.RequestHeaderCAKey,\n\t\t\t\tcontrolConfig.Runtime.ETCDPeerCA,\n\t\t\t\tcontrolConfig.Runtime.ETCDPeerCAKey,\n\t\t\t\tcontrolConfig.Runtime.ETCDServerCA,\n\t\t\t\tcontrolConfig.Runtime.ETCDServerCAKey,\n\t\t\t}\n\t\tcase version.Program + ProgramServer:\n\t\t\t// not handled here, as the dynamiclistener cert cache is not a standard cert\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"%s is not a recognized service\", service)\n\t\t}\n\t}\n\treturn fileMap, nil\n}\n\nfunc IsValid(svc string) bool {\n\tfor _, service := range All {\n\t\tif svc == service {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n","sourceCodeStart":129,"sourceCodeEnd":161,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/util/services/services.go#L129-L161","documentation":"FilesForServices maps each requested service name to its certificate/key file list; the switch recognizes only the package constants (api-server, admin, auth-proxy, certificate-authority, cloud-controller, controller-manager, etcd, kube-proxy, kubelet, scheduler, supervisor, plus <program>-controller and <program>-server built from version.Program). Any other string hits the default branch. The exported constants and services.IsValid exist precisely to avoid this.","triggerScenarios":"Calling services.FilesForServices with raw strings like \"kube-apiserver\" (the constant value is \"api-server\"), a typo, or a service name from a different version's naming scheme.","commonSituations":"Using raw strings instead of the exported constants; configs or scripts copied from older versions where names differed; passing user-supplied service lists (e.g. from a cert-rotation command) into the function without validation.","solutions":["Replace raw strings with the exported constants: services.APIServer, services.Kubelet, services.ETCD, services.AuthProxy, ...","Validate before calling: for each name check services.IsValid(s) and reject early","Print or inspect services.All in your version for the exact accepted names before constructing the list"],"exampleFix":"// before\nm, err := services.FilesForServices(cfg, []string{\"kube-apiserver\", \"kubelet\"})\n// after\nm, err := services.FilesForServices(cfg, []string{services.APIServer, services.Kubelet})","handlingStrategy":"type-guard","validationCode":"for _, svc := range requested {\n\tif !services.IsValid(svc) {\n\t\treturn fmt.Errorf(\"unknown service %q; valid: %v\", svc, services.All)\n\t}\n}\nfileMap, err := services.FilesForServices(controlConfig, requested)","typeGuard":"func isKnownService(svc string) bool { return services.IsValid(svc) }\n// note: services.IsValid checks services.All and does NOT include\n// services.CertificateAuthority (\"certificate-authority\"), even though\n// FilesForServices accepts it - pass that constant directly if needed.","tryCatchPattern":"fileMap, err := services.FilesForServices(cfg, svcs)\nif err != nil {\n\tif strings.Contains(err.Error(), \"is not a recognized service\") {\n\t\t// a name in the list is wrong: compare against services.All and fix the input\n\t\treturn nil, fmt.Errorf(\"%w (valid names: %v)\", err, services.All)\n\t}\n\treturn nil, err\n}","preventionTips":["Always use the exported constants (services.APIServer, services.Kubelet, ...) instead of raw strings","Validate user-supplied service names with services.IsValid before building the list","Re-check service name constants when upgrading - names derive from version.Program"],"tags":["go","certificates","services","configuration","k3s"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}