kubernetes/kops · error

cannot use both --admin and --user

Error message

cannot use both --admin and --user

What it means

The `kops export kubeconfig` command's Args validator rejects combining --admin (request admin credentials with a lifetime) and --user (export credentials for a specific regular user). The two credential modes are mutually exclusive, so passing both is a usage error returned before any cluster interaction.

Source

Thrown at cmd/kops/export_kubeconfig.go:74

type ExportKubeconfigOptions struct {
	ClusterName    string
	KubeConfigPath string
	all            bool
	kubeconfig.CreateKubecfgOptions
}

func NewCmdExportKubeconfig(f *util.Factory, out io.Writer) *cobra.Command {
	options := &ExportKubeconfigOptions{}

	cmd := &cobra.Command{
		Use:     "kubeconfig [CLUSTER | --all]",
		Aliases: []string{"kubecfg"},
		Short:   exportKubeconfigShort,
		Long:    exportKubeconfigLong,
		Example: exportKubeconfigExample,
		Args: func(cmd *cobra.Command, args []string) error {
			if options.Admin != 0 && options.User != "" {
				return fmt.Errorf("cannot use both --admin and --user")
			}
			if options.all {
				if len(args) != 0 {
					return fmt.Errorf("cannot use both --all flag and positional arguments")
				}
				return nil
			} else {
				return rootCommand.clusterNameArgs(&options.ClusterName)(cmd, args)
			}
		},
		ValidArgsFunction: commandutils.CompleteClusterName(f, true, false),
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunExportKubeconfig(cmd.Context(), f, out, options, args)
		},
	}

	cmd.Flags().StringVar(&options.KubeConfigPath, "kubeconfig", options.KubeConfigPath, "Filename of the kubeconfig to create")
	cmd.Flags().BoolVar(&options.all, "all", options.all, "Export all clusters from the kOps state store")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Drop --admin if you want a regular user's credentials: kops export kubeconfig --user <name>
2. Drop --user if you want admin/cluster credentials: kops export kubeconfig --admin[=duration]
3. Fix the calling script/alias so only one credential flag is passed

Example fix

// before
kops export kubeconfig mycluster --admin --user janes
// after
kops export kubeconfig mycluster --user janes

adminSet := flags.Changed("admin") || opts.Admin != 0
userSet := opts.User != ""
if adminSet && userSet {
    return errors.New("cannot use both --admin and --user")
}

out, err := exec.Command("kops", args...).CombinedOutput()
if err != nil && strings.Contains(string(out), "cannot use both --admin and --user") {
    // strip one credential flag and retry
}

When it happens

Trigger: Running `kops export kubeconfig --admin --user janes` or with --admin=<duration> together with --user; options.Admin != 0 and options.User != "" both set.

Common situations: Script templating that appends both flags; copying an example command and adding a second credential flag; aliases/scripts with baked-in --admin while user adds --user.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• cannot use both --all flag and positional arguments
• unsupported output type %q
• --name is required
• cannot specify --cert with "all"
• cannot load kubecfg settings for %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3c45842d3547923f. Report an issue: GitHub.