kubernetes/kops · error

unknown authorization mode %q

Error message

unknown authorization mode %q

What it means

NewCluster only accepts authorization modes 'AlwaysAllow' (AuthorizationFlagAlwaysAllow) and 'RBAC' (AuthorizationFlagRBAC, also the empty-string default). Any other value for opt.Authorization is rejected with this error.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:271

		}
	}

	cluster.Spec.ConfigStore = api.ConfigStoreSpec{
		Base: opt.ConfigBase,
	}
	configBase, err := clientset.ConfigBaseFor(cluster)
	if err != nil {
		return nil, fmt.Errorf("error building ConfigBase for cluster: %v", err)
	}
	cluster.Spec.ConfigStore.Base = configBase.Path()

	cluster.Spec.Authorization = &api.AuthorizationSpec{}
	if strings.EqualFold(opt.Authorization, AuthorizationFlagAlwaysAllow) {
		cluster.Spec.Authorization.AlwaysAllow = &api.AlwaysAllowAuthorizationSpec{}
	} else if opt.Authorization == "" || strings.EqualFold(opt.Authorization, AuthorizationFlagRBAC) {
		cluster.Spec.Authorization.RBAC = &api.RBACAuthorizationSpec{}
	} else {
		return nil, fmt.Errorf("unknown authorization mode %q", opt.Authorization)
	}

	cluster.Spec.IAM = &api.IAMSpec{
		AllowContainerRegistry: true,
	}
	cluster.Spec.Kubelet = &api.KubeletConfigSpec{
		AnonymousAuth: new(false),
	}

	if len(opt.KubernetesFeatureGates) > 0 {
		cluster.Spec.Kubelet.FeatureGates = make(map[string]string)
		cluster.Spec.KubeAPIServer = &api.KubeAPIServerConfig{
			FeatureGates: make(map[string]string),
		}
		cluster.Spec.KubeControllerManager = &api.KubeControllerManagerConfig{
			FeatureGates: make(map[string]string),
		}
		cluster.Spec.KubeProxy = &api.KubeProxyConfig{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use --authorization rbac (recommended) or --authorization alwaysallow
2. Omit the flag entirely — empty defaults to RBAC
3. Trim whitespace/typos from the flag value

Example fix

// before
kops create cluster --authorization abac --name c.example.com
// after
kops create cluster --authorization rbac --name c.example.com

allowed := map[string]bool{"": true, "rbac": true, "alwaysallow": true}
if !allowed[strings.ToLower(strings.TrimSpace(opt.Authorization))] {
    return fmt.Errorf("--authorization must be rbac or alwaysallow")
}

When it happens

Trigger: `kops create cluster --authorization <mode>` where mode is anything other than AlwaysAllow or RBAC (case-insensitive), e.g. legacy 'Abac', 'AlwaysAllowAll', or misspellings.

Common situations: Copying flags from old kOps documentation (ABAC was removed long ago); typos like 'rbca'; passing a value with stray whitespace that EqualFold does not match.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• updating Role Assignment is not yet implemented
• error adding needs-update label: %v
• error applying annotation to record addon installation: %v
• error querying namespace %q: %v
• error applying annotation to namespace: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/67bf06ca27b85764. Report an issue: GitHub.