kubernetes/kops · error

promoting keypairs for %q is not supported

Error message

promoting keypairs for %q is not supported

What it means

RunPromoteKeypair only supports keysets that are rotatable (those passing rotatableKeysetFilter, e.g. the well-known CAs and other rotatable keysets). Requesting promotion for any other keyset name is rejected before any cluster access.

Source

Thrown at cmd/kops/promote_keypair.go:118

			}

			return nil
		},
		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
			return completePromoteKeyset(cmd.Context(), f, options, args, toComplete)
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunPromoteKeypair(cmd.Context(), f, out, options)
		},
	}

	return cmd
}

// RunPromoteKeypair promotes a keypair.
func RunPromoteKeypair(ctx context.Context, f *util.Factory, out io.Writer, options *PromoteKeypairOptions) error {
	if !rotatableKeysetFilter(options.Keyset, nil) {
		return fmt.Errorf("promoting keypairs for %q is not supported", options.Keyset)
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.KopsClient()
	if err != nil {
		return fmt.Errorf("getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("getting keystore: %v", err)
	}

	if options.Keyset != "all" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use a rotatable keyset such as kubernetes-ca or apiserver-aggregator-ca
2. Use `all` to promote every rotatable keyset at once
3. Run `kops get keypairs --name <cluster>` to list valid keysets and check spelling

Example fix

// before
kops promote keypair service-account --name c
// after
kops promote keypair all --name c

case "$KEYSET" in
  all|kubernetes-ca|apiserver-aggregator-ca) ;;
  *) echo "keyset '$KEYSET' is not rotatable"; exit 1;;
esac

When it happens

Trigger: Running `kops promote keypair <keyset> --name <cluster>` with a keyset that is not in the rotatable set (e.g. a service-account signing keyset or an arbitrary/misspelled name).

Common situations: Typo in the keyset name; attempting to promote a keyset that kOps does not treat as rotatable; following older docs that referenced a non-rotatable keyset.

Related errors

• adding keypair to %q is not supported
• keyset not found
• at least one channel URL is required
• spec.PublicKey is required
• unable to execute --dry-run without setting --output

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9c2861ed1ddd240a. Report an issue: GitHub.