kubernetes/kops · error

adding keypair to %q is not supported

Error message

adding keypair to %q is not supported

What it means

RunCreateKeypair only supports adding keypairs to keysets that pass rotatableKeysetFilter (the rotatable CA-style keysets such as "ca", "service-account", etc.). A keyset name outside that allowlist (e.g. "all" handled separately, or a non-rotatable keyset like "apiserver-aggregator") is rejected with this message.

Source

Thrown at cmd/kops/create_keypair.go:148

		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completeCreateKeypair(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunCreateKeypair(cmd.Context(), f, out, options)
		},
	}

	cmd.Flags().StringVar(&options.CertPath, "cert", options.CertPath, "Path to CA certificate")
	cmd.Flags().StringVar(&options.PrivateKeyPath, "key", options.PrivateKeyPath, "Path to CA private key")
	cmd.Flags().BoolVar(&options.Primary, "primary", options.Primary, "Make the keypair the one used to issue certificates")

	return cmd
}

// RunCreateKeypair adds a custom CA certificate and private key.
func RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *CreateKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("adding keypair to %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("error getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("error getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	if options.Keyset != "all" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops get keypairs` to list valid keysets and pick a rotatable one.
2. Correct the --keyset spelling (e.g. "ca", not "certificate-authority").
3. If the keyset genuinely should be rotatable, check the kOps version — rotatable keyset support was added incrementally; upgrade kOps.

Example fix

// before
kops create keypair cluster.k8s.local --keyset apiserver
// after
kops create keypair cluster.k8s.local --keyset ca

ROTATABLE="^(all|ca|service-account)$"
[[ "$KEYSET" =~ $ROTATABLE ]] || { echo "keyset '$KEYSET' is not rotatable"; exit 1; }
kops create keypair "$CLUSTER" --keyset "$KEYSET"

When it happens

Trigger: `kops create keypair <cluster> --keyset <name>` where <name> is not a rotatable keyset per rotatableKeysetFilter (cmd/kops/create_keypair.go:148).

Common situations: Typo in keyset name; attempting to inject a keypair into a keyset that kOps generates itself; targeting legacy/deprecated keysets after a cluster upgrade.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• promoting keypairs for %q is not supported
• spec.PublicKey is required
• cannot specify --key with "all"
• cannot specify --primary with "all"
• unable to parse YAML %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/581b2d38f1bcdfa0. Report an issue: GitHub.