{"record":{"id":"f7892e1d49089030","repo":"kubernetes/kops","slug":"cannot-distrust-the-primary-keypair","errorCode":null,"errorMessage":"cannot distrust the primary keypair","messagePattern":"cannot distrust the primary keypair","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/distrust_keypair.go","lineNumber":171,"sourceCode":"\t}\n\n\tif len(keypairIDs) == 0 {\n\t\tprimarySerial := keyset.Primary.Certificate.Certificate.SerialNumber\n\t\tfor id, item := range keyset.Items {\n\t\t\tif item.DistrustTimestamp == nil && item.Certificate.Certificate.SerialNumber.Cmp(primarySerial) < 0 {\n\t\t\t\tkeypairIDs = append(keypairIDs, id)\n\t\t\t}\n\t\t}\n\n\t\tif len(keypairIDs) == 0 {\n\t\t\tklog.Infof(\"No %s keypairs older than the primary.\", name)\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tfor _, id := range keypairIDs {\n\t\tif id == keyset.Primary.Id {\n\t\t\treturn fmt.Errorf(\"cannot distrust the primary keypair\")\n\t\t}\n\t\titem := keyset.Items[id]\n\t\tif item == nil {\n\t\t\treturn fmt.Errorf(\"keypair not found\")\n\t\t}\n\n\t\tif item.DistrustTimestamp != nil {\n\t\t\tcontinue\n\t\t}\n\n\t\tnow := time.Now().UTC().Round(0)\n\t\titem.DistrustTimestamp = &now\n\n\t\tif err := keyStore.StoreKeyset(ctx, name, keyset); err != nil {\n\t\t\treturn fmt.Errorf(\"error storing keyset: %w\", err)\n\t\t}\n\n\t\tfmt.Fprintf(out, \"Distrusted %s %s\\n\", name, id)","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/distrust_keypair.go#L153-L189","documentation":"distrustKeypair refuses to mark the keyset's primary (currently-trusted) keypair as distrusted: one of the provided (or auto-derived) keypair IDs equals keyset.Primary.Id. Revoking the primary would invalidate the active certificate chain.","triggerScenarios":"Thrown at cmd/kops/distrust_keypair.go:171 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Promote a newer keypair to primary first (kops promote keypair), then distrust the old one","Remove the primary's ID from the distrust list"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}