kubernetes/kops · error

can only add to one keyset at a time

Error message

can only add to one keyset at a time

What it means

To keep argument handling simple, the command accepts only one keyset per invocation. If more than one positional argument is supplied, the validator rejects the call with this message rather than guessing.

Source

Thrown at cmd/kops/create_keypair.go:113

		Use:     "keypair {KEYSET | all}",
		Short:   createKeypairShort,
		Long:    createKeypairLong,
		Example: createKeypairExample,
		Args: func(cmd *cobra.Command, args []string) error {
			options.ClusterName = rootCommand.ClusterName(true)

			if options.ClusterName == "" {
				return fmt.Errorf("--name is required")
			}

			if len(args) == 0 {
				return fmt.Errorf("must specify name of keyset to add keypair to")
			}

			options.Keyset = args[0]

			if len(args) != 1 {
				return fmt.Errorf("can only add to one keyset at a time")
			}

			if options.Keyset == "all" {
				if options.CertPath != "" {
					return fmt.Errorf("cannot specify --cert with \"all\"")
				}
				if options.PrivateKeyPath != "" {
					return fmt.Errorf("cannot specify --key with \"all\"")
				}
				if options.Primary {
					return fmt.Errorf("cannot specify --primary with \"all\"")
				}
			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completeCreateKeypair(cmd.Context(), f, options, args, toComplete)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the command once per keyset instead of passing several names
2. Quote or disable globs if shell expansion added extra arguments
3. Verify with `kops create keypair --help` that only a single KEYSET argument is accepted

Example fix

// before
kops create keypair --name c.k8s.local apiserver kubelet
// after
kops create keypair --name c.k8s.local apiserver
kops create keypair --name c.k8s.local kubelet

[ $# -eq 1 ] || { echo "pass exactly one keyset; loop over keysets instead" >&2; exit 2; }

When it happens

Trigger: Running `kops create keypair --name <cluster> apiserver kubelet` — two keyset names in a single command.

Common situations: Assuming multiple keysets can be batched like other bulk kubectl operations; shell glob expansion matching several names (e.g. `kops create keypair *`); accidentally leaving an extra token from a copied command line.

Related errors

• must specify name of keyset to add keypair to
• at least one channel URL is required
• spec.PublicKey is required
• unable to execute --dry-run without setting --output
• --name is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d7924ee9c9de9057. Report an issue: GitHub.