{"record":{"id":"ea6fb916e4a4ff70","repo":"kubernetes/kops","slug":"must-specify-q-label-with-cluster-name-to-replace-ea6fb9","errorCode":null,"errorMessage":"must specify %q label with cluster name to replace SSHCredential","messagePattern":"must specify %q label with cluster name to replace SSHCredential","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/replace.go","lineNumber":200,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tswitch ig {\n\t\t\t\tcase nil:\n\t\t\t\t\tklog.Infof(\"instanceGroup: %v was not found, creating resource now\", igName)\n\t\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"error creating instanceGroup: %v\", err)\n\t\t\t\t\t}\n\t\t\t\tdefault:\n\t\t\t\t\t_, err = clientset.InstanceGroupsFor(cluster).Update(ctx, v, metav1.UpdateOptions{})\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"error replacing instanceGroup: %v\", err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tcase *kopsapi.SSHCredential:\n\t\t\t\tclusterName := v.ObjectMeta.Labels[kopsapi.LabelClusterName]\n\t\t\t\tif clusterName == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"must specify %q label with cluster name to replace SSHCredential\", kopsapi.LabelClusterName)\n\t\t\t\t}\n\t\t\t\tif v.Spec.PublicKey == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"spec.PublicKey is required\")\n\t\t\t\t}\n\n\t\t\t\tcluster, err := clientset.GetCluster(ctx, clusterName)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tsshKeyArr := []byte(v.Spec.PublicKey)\n\t\t\t\terr = sshCredentialStore.AddSSHPublicKey(ctx, sshKeyArr)\n\t\t\t\tif err != nil {","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/replace.go#L182-L218","documentation":"When replacing an SSHCredential object, `kops replace` derives the target cluster from the metadata label `kops.k8s.io/cluster` (kopsapi.LabelClusterName). The manifest lacks that label, so the command cannot determine which cluster's SSH credential store to write to and aborts.","triggerScenarios":"Applying an SSHCredential YAML that has no `metadata.labels.kops.k8s.io/cluster: <clustername>` entry, e.g. a hand-written manifest or one exported from a source that stripped labels.","commonSituations":"Hand-authoring an SSH credential manifest from documentation examples; copying a manifest between clusters and removing/renaming labels; exporting with a tool that drops metadata labels.","solutions":["Add the label to the manifest: `metadata.labels.kops.k8s.io: <cluster-name>` (the exact kops.k8s.io/cluster key).","Or export an existing correct manifest with `kops get sshpublickey <cluster> -o yaml` as a template.","Specify the cluster on the command line (`kops replace -f ssh.yaml --name <cluster>`) where supported, so other fields are validated against the right cluster."],"exampleFix":"# before\nmetadata:\n  name: admin\n# after\nmetadata:\n  name: admin\n  labels:\n    kops.k8s.io/cluster: mycluster.example.com","handlingStrategy":"validation","validationCode":"func validateSSHCred(manifest map[string]interface{}) error {\n    meta, _ := manifest[\"metadata\"].(map[string]interface{})\n    labels, _ := meta[\"labels\"].(map[string]interface{})\n    if labels[\"kops.k8s.io/cluster\"] == \"\" {\n        return fmt.Errorf(\"manifest must set metadata.labels.kops.k8s.io/cluster\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include the kops.k8s.io/cluster label in SSHCredential manifests","Generate manifests from `kops get sshpublickey -o yaml` rather than hand-writing","Lint kops manifests in CI for required labels","Never strip labels when copying manifests between clusters"],"tags":["kops","sshcredential","validation","manifest","labels"],"backgroundTag":"missing-required-label","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}