kubernetes/kops · error

unrecognized key %q in token %q

Error message

unrecognized key %q in token %q

What it means

Thrown by parsePkixName while parsing a comma-separated pkix name string (e.g. "O=kOps,CN=kops-controller"): a token parsed as k=v used a key other than the supported "cn" (CommonName) or "o" (Organization). Keys are lowercased first, so this fires for misspelled or unsupported attributes like "ou=", "email=", or "c=".

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:341

	name := new(pkix.Name)

	tokens := strings.Split(s, ",")
	for _, token := range tokens {
		token = strings.TrimSpace(token)
		kv := strings.SplitN(token, "=", 2)
		if len(kv) != 2 {
			return nil, fmt.Errorf("unrecognized token (expected k=v): %q", token)
		}
		k := strings.ToLower(kv[0])
		v := kv[1]

		switch k {
		case "cn":
			name.CommonName = v
		case "o":
			name.Organization = append(name.Organization, v)
		default:
			return nil, fmt.Errorf("unrecognized key %q in token %q", k, token)
		}
	}

	return name, nil
}

func (e *Keypair) ensureResources() {
	if e.certificates == nil {
		e.certificates = &fi.CloudupTaskDependentResource{
			Resource: fi.NewStringResource("<< TO BE GENERATED >>\n"),
			Task:     e,
		}
		e.keyset = &fi.Keyset{
			Primary: &fi.KeysetItem{
				Id: "<< TO BE GENERATED >>",
			},
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove or rewrite unsupported DN components; keep only CN and O in the subject.
2. Map desired organizational info into the O field (multiple O tokens are allowed and appended).
3. If extra components are genuinely needed, upstream change to parsePkixName is required.

Example fix

// before
subject: "CN=etcd,O=Example,OU=Platform"
// after
subject: "CN=etcd,O=Example,O=Platform"

allowed := map[string]bool{"cn": true, "o": true}
for _, tok := range strings.Split(subject, ",") {
    kv := strings.SplitN(strings.TrimSpace(tok), "=", 2)
    if len(kv) == 2 && !allowed[strings.ToLower(kv[0])] {
        return fmt.Errorf("unsupported DN key %q", kv[0])
    }
}

if err != nil { return fmt.Errorf("subject %q: only CN and O are supported: %w", s, err) }

When it happens

Trigger: A keypair subject contains a supported k=v token whose key is not "cn" or "o", e.g. "CN=api,OU=Platform".

Common situations: Users copying standard OpenSSL/LDAP distinguished names (with OU, C, DC, etc.) into kops keypair subject config.

Related errors

• unrecognized token (expected k=v): %q
• parsing additional containerd config entry %q: %w
• invalid EtcdClusterSpec (expected two tokens): %q
• invalid EtcdClusterSpec (member not found in all nodes): %q
• unexpected boolean value: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b0f7c8aef381ca90. Report an issue: GitHub.