kubernetes/kops · error

cannot specify --primary with "all"

Error message

cannot specify --primary with "all"

What it means

Same family as the --key / --cert rejections with `--keyset all`: `--primary` designates the new keypair as primary for a single keyset, which is meaningless (and ambiguous) when rotating `all` keysets at once. The Args validator rejects the combination up front.

Source

Thrown at cmd/kops/create_keypair.go:124

			if len(args) == 0 {
				return fmt.Errorf("must specify name of keyset to add keypair to")
			}

			options.Keyset = args[0]

			if len(args) != 1 {
				return fmt.Errorf("can only add to one keyset at a time")
			}

			if options.Keyset == "all" {
				if options.CertPath != "" {
					return fmt.Errorf("cannot specify --cert with \"all\"")
				}
				if options.PrivateKeyPath != "" {
					return fmt.Errorf("cannot specify --key with \"all\"")
				}
				if options.Primary {
					return fmt.Errorf("cannot specify --primary with \"all\"")
				}
			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completeCreateKeypair(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunCreateKeypair(cmd.Context(), f, out, options)
		},
	}

	cmd.Flags().StringVar(&options.CertPath, "cert", options.CertPath, "Path to CA certificate")
	cmd.Flags().StringVar(&options.PrivateKeyPath, "key", options.PrivateKeyPath, "Path to CA private key")
	cmd.Flags().BoolVar(&options.Primary, "primary", options.Primary, "Make the keypair the one used to issue certificates")

	return cmd

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove --primary when using --keyset all.
2. If primary designation is required, run per keyset: `kops create keypair <cluster> --keyset <name> --primary`.
3. Check `kops get keypairs` afterwards to confirm which key became primary.

Example fix

// before
kops create keypair cluster.k8s.local --keyset all --primary
// after
kops create keypair cluster.k8s.local --keyset ca --primary

if [[ "$KEYSET" == "all" && "$PRIMARY" == "true" ]]; then echo "--primary cannot be combined with --keyset all"; exit 1; fi
kops create keypair "$CLUSTER" --keyset "$KEYSET" $([[ "$PRIMARY" == "true" && "$KEYSET" != "all" ]] && echo --primary)

When it happens

Trigger: Running `kops create keypair <cluster> --keyset all --primary` — options.Keyset == "all" and options.Primary == true in the Args validator (cmd/kops/create_keypair.go:124).

Common situations: Operators who just rotated with `--keyset all` and want the new keys to be primary, not realizing --primary requires a specific keyset; scripted follow-up commands appending --primary unconditionally.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• cannot specify --key with "all"
• adding keypair to %q is not supported
• must specify %q label with cluster name to create instanceGr
• error querying cluster %q: %v
• cluster %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/58b9a9517f3e52c6. Report an issue: GitHub.