kubernetes/kops · error

cannot distrust the primary keypair

Error message

cannot distrust the primary keypair

What it means

distrustKeypair refuses to mark the keyset's primary (currently-trusted) keypair as distrusted: one of the provided (or auto-derived) keypair IDs equals keyset.Primary.Id. Revoking the primary would invalidate the active certificate chain.

Source

Thrown at cmd/kops/distrust_keypair.go:171

	}

	if len(keypairIDs) == 0 {
		primarySerial := keyset.Primary.Certificate.Certificate.SerialNumber
		for id, item := range keyset.Items {
			if item.DistrustTimestamp == nil && item.Certificate.Certificate.SerialNumber.Cmp(primarySerial) < 0 {
				keypairIDs = append(keypairIDs, id)
			}
		}

		if len(keypairIDs) == 0 {
			klog.Infof("No %s keypairs older than the primary.", name)
			return nil
		}
	}

	for _, id := range keypairIDs {
		if id == keyset.Primary.Id {
			return fmt.Errorf("cannot distrust the primary keypair")
		}
		item := keyset.Items[id]
		if item == nil {
			return fmt.Errorf("keypair not found")
		}

		if item.DistrustTimestamp != nil {
			continue
		}

		now := time.Now().UTC().Round(0)
		item.DistrustTimestamp = &now

		if err := keyStore.StoreKeyset(ctx, name, keyset); err != nil {
			return fmt.Errorf("error storing keyset: %w", err)
		}

		fmt.Fprintf(out, "Distrusted %s %s\n", name, id)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Promote a newer keypair to primary first (kops promote keypair), then distrust the old one
2. Remove the primary's ID from the distrust list

When it happens

Trigger: Thrown at cmd/kops/distrust_keypair.go:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f7892e1d49089030. Report an issue: GitHub.