k3s-io/k3s · error

service %s is not recognized

Error message

service %s is not recognized

What it means

validateCertConfig runs for `k3s cert` subcommands (rotate/list) and checks every entry of --service against the fixed set of cert-managed services: agent-side kube-proxy, kubelet, <program>-controller; server-side api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, <program>-server (e.g. k3s-server). Any other string — including typos or internal names like certificate-authority — is rejected.

Source

Thrown at pkg/cli/cert/cert.go:359

	for _, files := range fileMap {
		for _, file := range files {
			if strings.HasPrefix(file, agentDataDir) {
				cert := filepath.Base(file)
				tlsBackupCert := filepath.Join(tlsBackupDir, cert)
				if err := util.CopyFile(file, tlsBackupCert, true); err != nil {
					return "", err
				}
			}
		}
	}

	return tlsBackupDir, nil
}

func validateCertConfig() error {
	for _, s := range cmds.ServicesList.Value() {
		if !services.IsValid(s) {
			return errors.New("service " + s + " is not recognized")
		}
	}
	return nil
}

func RotateCA(app *cli.Context) error {
	if err := cmds.InitLogging(); err != nil {
		return err
	}
	return rotateCA(app, &cmds.ServerConfig, &cmds.CertRotateCAConfig)
}

func rotateCA(app *cli.Context, cfg *cmds.Server, sync *cmds.CertRotateCA) error {
	var serverConfig server.Config

	_, err := commandSetup(app, cfg, &serverConfig)
	if err != nil {
		return err

View on GitHub (pinned to 6ba341e396)

Solutions

1. Use a valid service name: one of api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, kube-proxy, kubelet, k3s-server, k3s-controller
2. For CA/certificate-authority rotation use the dedicated `k3s certificate rotate-ca` command instead of --service
3. List what the flags accept via k3s cert rotate --help before scripting

Example fix

# before
k3s cert rotate --service kube-apiserver  # -> service kube-apiserver is not recognized

# after
k3s cert rotate --service api-server

valid := map[string]bool{}
for _, s := range services.All { valid[s] = true } // api-server, admin, auth-proxy, cloud-controller, controller-manager, etcd, scheduler, supervisor, kube-proxy, kubelet, <prog>-server, <prog>-controller
for _, s := range requestedServices {
    if !valid[s] { return fmt.Errorf("unknown service %q; valid: %v", s, services.All) }
}

func isValidService(svc string, all []string) bool {
    for _, s := range all { if svc == s { return true } }
    return false
}

When it happens

Trigger: k3s cert rotate --service=kube-apiserver (wrong name; valid is api-server); --service=certificate-authority (CA rotation is handled by a separate rotate-ca flow, not --service); arbitrary strings not in services.All.

Common situations: Admins guessing Kubernetes component names instead of k3s service names; scripts written against other distributions; attempting CA rotation through the wrong flag.

Related errors

• cannot use current data for %s; field is not settable
• --server is required
• no snapshots given for removal
• invalid output format:
• no certificates loaded from etcd-s3-endpoint-ca

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/6b14ed17f5d0c976. Report an issue: GitHub.