kubernetes/kops · error

unexpected key name

Error message

unexpected key name

What it means

After the allowlist check, issueCert switches on the requested key name to set the certificate subject. A name that passes the allowlist but has no case in the switch indicates an internal inconsistency between certNames and the switch, so the server returns "unexpected key name".

Source

Thrown at cmd/kops-controller/pkg/server/server.go:339

			CommonName:   fmt.Sprintf("system:node:%s", id.NodeName),
			Organization: []string{rbac.NodesGroup},
		}
	case "kubelet-server":
		issueReq.Subject = pkix.Name{
			CommonName: id.NodeName,
		}
		issueReq.AlternateNames = id.CertificateNames
		issueReq.Type = "server"
	case "kube-proxy":
		issueReq.Subject = pkix.Name{
			CommonName: rbac.KubeProxy,
		}
	case "kube-router":
		issueReq.Subject = pkix.Name{
			CommonName: rbac.KubeRouter,
		}
	default:
		return "", fmt.Errorf("unexpected key name")
	}

	// This field was added to the protocol in kOps 1.22.
	if len(keypairIDs) > 0 {
		if keypairIDs[issueReq.Signer] != s.keypairIDs[issueReq.Signer] {
			return "", fmt.Errorf("request's keypair ID %q for %s didn't match server's %q", keypairIDs[issueReq.Signer], issueReq.Signer, s.keypairIDs[issueReq.Signer])
		}
	}

	cert, _, _, err := pki.IssueCert(ctx, issueReq, s.keystore)
	if err != nil {
		return "", fmt.Errorf("issuing certificate: %v", err)
	}

	return cert.AsString()
}

// recovery is responsible for ensuring we don't exit on a panic.

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the --cert-names flag values to the exact supported names (kubelet, kube-router, etcd-client-cilium, etc.)
2. Upgrade kops-controller to match the kOps version that introduced the requested key name
3. Regenerate the controller manifest with `kops update cluster` instead of hand-editing

Example fix

// before
--cert-names=kubelet,kuberouter
// after
--cert-names=kubelet,kube-router

var knownCertNames = map[string]bool{
    "kubelet": true, "kube-router": true, "etcd-client-cilium": true,
}
if !knownCertNames[name] {
    return fmt.Errorf("unknown cert name %q", name)
}

func isKnownCertName(name string) bool {
    switch name {
    case "kubelet", "kube-router", "etcd-client-cilium", "etcd-client-events":
        return true
    }
    return false
}

if err != nil && strings.Contains(err.Error(), "unexpected key name") {
    log.Printf("requested cert name %q unsupported by controller build %s; upgrade controller", name, version)
}

When it happens

Trigger: The controller was started with a --cert-names value that is not one of the known names handled in the switch (typo, or a name added to the flag but not supported by this kops-controller build).

Common situations: Hand-edited controller Deployment args introducing a typo; version skew where a newer client requests a key name the older controller binary does not know; configuration drift after partial upgrades.

Related errors

• key name not enabled
• decoding pem public key
• unexpected key type %q
• parsing key: %v
• request's keypair ID %q for %s didn't match server's %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/04f40efdc09fea00. Report an issue: GitHub.