kubernetes/kops · error

cannot use both --admin and --user

Error message

cannot use both --admin and --user

What it means

`kops update cluster` rejects mutually exclusive authentication-related flags: --admin (create admin kubeconfig with a given lifetime) and --user (impersonate an existing user) cannot be combined. RunUpdateCluster returns this validation error before doing any cluster work.

Source

Thrown at cmd/kops/update_cluster.go:229

	Cluster *kops.Cluster
}

func RunCoreUpdateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *CoreUpdateClusterOptions) (*UpdateClusterResults, error) {
	opt := &UpdateClusterOptions{}
	opt.CoreUpdateClusterOptions = *c
	opt.Reconcile = false
	opt.CreateKubecfgOptions.CreateKubecfg = false
	return RunUpdateCluster(ctx, f, out, opt)
}

func RunUpdateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *UpdateClusterOptions) (*UpdateClusterResults, error) {
	results := &UpdateClusterResults{}

	isDryrun := false
	targetName := c.Target

	if c.Admin != 0 && c.User != "" {
		return nil, fmt.Errorf("cannot use both --admin and --user")
	}

	if c.Admin != 0 && !c.CreateKubecfg {
		klog.Info("--admin implies --create-kube-config")
		c.CreateKubecfg = true
	}

	if c.User != "" && !c.CreateKubecfg {
		klog.Info("--user implies --create-kube-config")
		c.CreateKubecfg = true
	}

	if c.Internal && !c.CreateKubecfg {
		klog.Info("--internal implies --create-kube-config")
		c.CreateKubecfg = true
	}

	// direct requires --yes (others do not, because they don't do anything!)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove --admin if you want a kubeconfig that impersonates --user
2. Remove --user if you want an admin client certificate via --admin
3. Split the invocations: generate an admin kubeconfig and a user kubeconfig separately

Example fix

// before
kops update cluster c.k8s.local --admin 87600h --user jdoe --yes
// after
kops update cluster c.k8s.local --user jdoe --yes

if (opts.Admin != 0) == (opts.User != "") && opts.Admin != 0 {
	return errors.New("--admin and --user are mutually exclusive")
}
_ = runUpdateCluster(opts)

When it happens

Trigger: Invoking `kops update cluster ... --admin 87600h --user jdoe` (or --admin with any nonzero duration plus a non-empty --user). Both select the kubeconfig credential mode, so only one may be set.

Common situations: Script accumulated flags over time; copying an example command and appending --user to an existing --admin; converting a script from admin-kubeconfig mode to impersonation mode without removing --admin.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• unsupported output type %q
• --project cannot be empty; specify a project or omit the fla
• cannot specify --key with "all"
• cannot specify --primary with "all"
• cannot load kubecfg settings for %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/79689180ab68e3ef. Report an issue: GitHub.