kubernetes/kops · error

can only promote to one keyset at a time

Error message

can only promote to one keyset at a time

What it means

The promote keypair command's argument validator allows at most two positional args (KEYSET and optionally ID); this fires when more than two were supplied, since promotion targets exactly one keyset (and one keypair) at a time.

Source

Thrown at cmd/kops/promote_keypair.go:92

		Use:     "keypair {KEYSET [ID] | all}",
		Short:   promoteKeypairShort,
		Long:    promoteKeypairLong,
		Example: promoteKeypairExample,
		Args: func(cmd *cobra.Command, args []string) error {
			options.ClusterName = rootCommand.ClusterName(true)

			if options.ClusterName == "" {
				return fmt.Errorf("--name is required")
			}

			if len(args) == 0 {
				return fmt.Errorf("must specify name of keyset promote keypair in")
			}

			options.Keyset = args[0]

			if len(args) > 2 {
				return fmt.Errorf("can only promote to one keyset at a time")
			}
			if len(args) > 1 {
				if options.Keyset == "all" {
					return fmt.Errorf("cannot specify ID with \"all\"")
				}

				options.KeypairID = args[1]
			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completePromoteKeyset(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunPromoteKeypair(cmd.Context(), f, out, options)
		},
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass exactly one keyset (and optionally one ID): `kops promote keypair <keyset> [ID] --name <cluster>`
2. Use `all` instead of enumerating keysets: `kops promote keypair all --name <cluster>`
3. Remove extra positional arguments from your script line

Example fix

// before
kops promote keypair kubernetes-ca apiserver-aggregator-ca --name c
// after
kops promote keypair all --name c

args=(kubernetes-ca 3 all)
[ ${#args[@]} -le 2 ] || { echo "max args: keyset [ID]"; exit 1; }

When it happens

Trigger: Running e.g. `kops promote keypair kubernetes-ca 3 all --name <cluster>` or otherwise passing multiple keysets/extra arguments.

Common situations: Listing several keysets hoping for a batch promotion; accidentally appending extra tokens from a script; misunderstanding the ID argument as an additional keyset.

Related errors

• unable to parse argument %q as url
• too many arguments
• cannot mix --name for cluster with positional arguments
• unknown output format: %q
• must specify name of keyset promote keypair in

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9e6626c88321f5f1. Report an issue: GitHub.