kubernetes/kops · error

cannot specify --cert with "all"

Error message

cannot specify --cert with "all"

What it means

The special keyset name "all" regenerates every keyset, but the command also supports supplying an existing certificate via --cert. These modes are mutually exclusive — you cannot both rotate everything and inject a specific certificate — so the validator rejects the combination upfront.

Source

Thrown at cmd/kops/create_keypair.go:118

			options.ClusterName = rootCommand.ClusterName(true)

			if options.ClusterName == "" {
				return fmt.Errorf("--name is required")
			}

			if len(args) == 0 {
				return fmt.Errorf("must specify name of keyset to add keypair to")
			}

			options.Keyset = args[0]

			if len(args) != 1 {
				return fmt.Errorf("can only add to one keyset at a time")
			}

			if options.Keyset == "all" {
				if options.CertPath != "" {
					return fmt.Errorf("cannot specify --cert with \"all\"")
				}
				if options.PrivateKeyPath != "" {
					return fmt.Errorf("cannot specify --key with \"all\"")
				}
				if options.Primary {
					return fmt.Errorf("cannot specify --primary with \"all\"")
				}
			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completeCreateKeypair(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunCreateKeypair(cmd.Context(), f, out, options)
		},
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove the --cert flag when using the "all" keyset
2. Target the specific keyset instead: `kops create keypair --name <cluster> --cert cert.pem <keyset>`
3. Review the command in scripts so flags from a bulk-rotation path don't leak into a specific-keyset path (or vice versa)

Example fix

// before
kops create keypair --name c.k8s.local --cert ca.crt all
// after
kops create keypair --name c.k8s.local --cert ca.crt ca
// or bulk rotation without --cert:
kops create keypair --name c.k8s.local all

if [ "$KEYSET" = "all" ] && [ -n "$CERT_PATH" ]; then echo "--cert cannot be used with keyset 'all'" >&2; exit 2; fi

func canUseAllKeyset(certPath, keyPath string, primary bool) bool { return certPath == "" && keyPath == "" && !primary }

When it happens

Trigger: Running `kops create keypair --name <cluster> --cert /path/to/cert.pem all` (i.e. keyset "all" combined with --cert).

Common situations: Scripting a bulk rotation while leftover --cert/--key/--primary flags remain set from a previous invocation; misunderstanding "all" as a wildcard that also accepts per-keyset options.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• unsupported output type %q
• --name is required
• unknown output format: %q
• unsupported output format: %q
• unknown output format: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5e5c487b4c416e0e. Report an issue: GitHub.