kubernetes/kops · error

key name not enabled

Error message

key name not enabled

What it means

The controller only issues certificates for key names explicitly enabled on the server (s.certNames, configured per-controller via certNames flag). If the requested name is not in that allowlist, issueCert rejects it with "key name not enabled".

Source

Thrown at cmd/kops-controller/pkg/server/server.go:311

		return "", fmt.Errorf("decoding pem public key")
	}
	if block.Type != "RSA PUBLIC KEY" {
		return "", fmt.Errorf("unexpected key type %q", block.Type)
	}
	key, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return "", fmt.Errorf("parsing key: %v", err)
	}

	issueReq := &pki.IssueCertRequest{
		Signer:    fi.CertificateIDCA,
		Type:      "client",
		PublicKey: key,
		Validity:  time.Hour * time.Duration(validHours),
	}

	if !s.certNames.Has(name) {
		return "", fmt.Errorf("key name not enabled")
	}
	switch name {
	case "etcd-client-cilium":
		issueReq.Signer = "etcd-clients-ca-cilium"
		issueReq.Subject = pkix.Name{
			CommonName: "cilium",
		}
	case "kubelet":
		issueReq.Subject = pkix.Name{
			CommonName:   fmt.Sprintf("system:node:%s", id.NodeName),
			Organization: []string{rbac.NodesGroup},
		}
	case "kubelet-server":
		issueReq.Subject = pkix.Name{
			CommonName: id.NodeName,
		}
		issueReq.AlternateNames = id.CertificateNames
		issueReq.Type = "server"

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add the missing name to the kops-controller --cert-names flag in its Deployment manifest and restart the pod
2. Re-run `kops update cluster` so the controller manifest is regenerated with the correct cert names for the cluster spec
3. Check the cluster spec for enabled features (networking plugin) and ensure the controller config matches

Example fix

// before (Deployment args)
args: ["--server", "--cloud=aws"]
// after
args: ["--server", "--cloud=aws", "--cert-names=kubelet,etcd-client-cilium,kube-router"]

// before calling issueCert, check the server allowlist
if !allowedCertNames.Has(requestedName) {
    return fmt.Errorf("cert name %q not in controller --cert-names", requestedName)
}

func isCertNameEnabled(name string, certNames sets.Set[string]) bool {
    return certNames.Has(name)
}

_, err := client.Bootstrap(ctx, req)
if err != nil && strings.Contains(err.Error(), "key name not enabled") {
    log.Printf("controller lacks --cert-names entry for %q; fix Deployment args", name)
}

When it happens

Trigger: A node calls bootstrap/issueCert with a name (e.g. etcd-client-cilium, kube-router, kubelet) that the controller instance was not started with in its --cert-names list.

Common situations: Running kops-controller without the full set of --cert-names flags for the cluster's features (Cilium, kube-router enabled in the cluster spec but not the controller), or misconfigured controller Deployment manifest after cluster feature changes.

Related errors

• unexpected key name
• decoding pem public key
• unexpected key type %q
• parsing key: %v
• request's keypair ID %q for %s didn't match server's %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8a111f44f693d853. Report an issue: GitHub.