kubernetes/kops · error

cannot specify --key with "all"

Error message

cannot specify --key with "all"

What it means

kops `create keypair` supports rotating a whole keyset or supplying a custom certificate/private key, but not both at once. When `--keyset all` is passed (meaning 'add a keypair to every rotatable keyset'), supplying `--key` is contradictory because a single private key cannot apply to all keysets. The cobra command's Args validator rejects the flag combination before any cluster work starts.

Source

Thrown at cmd/kops/create_keypair.go:121

				return fmt.Errorf("--name is required")
			}

			if len(args) == 0 {
				return fmt.Errorf("must specify name of keyset to add keypair to")
			}

			options.Keyset = args[0]

			if len(args) != 1 {
				return fmt.Errorf("can only add to one keyset at a time")
			}

			if options.Keyset == "all" {
				if options.CertPath != "" {
					return fmt.Errorf("cannot specify --cert with \"all\"")
				}
				if options.PrivateKeyPath != "" {
					return fmt.Errorf("cannot specify --key with \"all\"")
				}
				if options.Primary {
					return fmt.Errorf("cannot specify --primary with \"all\"")
				}
			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completeCreateKeypair(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunCreateKeypair(cmd.Context(), f, out, options)
		},
	}

	cmd.Flags().StringVar(&options.CertPath, "cert", options.CertPath, "Path to CA certificate")
	cmd.Flags().StringVar(&options.PrivateKeyPath, "key", options.PrivateKeyPath, "Path to CA private key")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove the --key flag when using --keyset all.
2. If you intended to add a key to one specific keyset, replace `all` with the keyset name (e.g. --keyset ca).
3. To provide keys for every keyset, run `kops create keypair` once per keyset with the appropriate --key.

Example fix

// before
kops create keypair cluster.k8s.local --keyset all --key /path/to/private.key
// after
kops create keypair cluster.k8s.local --keyset ca --key /path/to/private.key

if [[ "$KEYSET" == "all" && -n "$KEY" ]]; then echo "--key cannot be combined with --keyset all"; exit 1; fi
kops create keypair "$CLUSTER" --keyset "$KEYSET" ${KEY:+--key "$KEY"}

When it happens

Trigger: Running `kops create keypair <cluster> --keyset all --key <path>` — i.e. options.Keyset == "all" and options.PrivateKeyPath != "" in the command's Args validation (cmd/kops/create_keypair.go:121).

Common situations: Operators automating CA rotation script `kops create keypair ... all` and paste in the same --key/--cert flags used for a single-keyset invocation; copy-paste from older runbooks targeting one keyset.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• cannot specify --primary with "all"
• adding keypair to %q is not supported
• must specify %q label with cluster name to create instanceGr
• error querying cluster %q: %v
• cluster %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/64c10929886f88e7. Report an issue: GitHub.