kubernetes/kops · error

unrecognized token (expected k=v): %q

Error message

unrecognized token (expected k=v): %q

What it means

parsePkixName parses a PKIX distinguished-name string (comma-separated k=v tokens) used for certificate subjects. If any comma-separated token does not contain an '=' sign, parsing fails with this error, aborting keypair Render.

Source

Thrown at upup/pkg/fi/fitasks/keypair.go:330

	keyset.Primary = ki

	err = keystore.StoreKeyset(ctx, name, keyset)
	if err != nil {
		return nil, err
	}

	return keyset, nil
}

func parsePkixName(s string) (*pkix.Name, error) {
	name := new(pkix.Name)

	tokens := strings.Split(s, ",")
	for _, token := range tokens {
		token = strings.TrimSpace(token)
		kv := strings.SplitN(token, "=", 2)
		if len(kv) != 2 {
			return nil, fmt.Errorf("unrecognized token (expected k=v): %q", token)
		}
		k := strings.ToLower(kv[0])
		v := kv[1]

		switch k {
		case "cn":
			name.CommonName = v
		case "o":
			name.Organization = append(name.Organization, v)
		default:
			return nil, fmt.Errorf("unrecognized key %q in token %q", k, token)
		}
	}

	return name, nil
}

func (e *Keypair) ensureResources() {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the subject string so every comma-separated token is key=value, e.g. "CN=example.com,O=MyOrg".
2. Only supported keys are cn and o — replace unsupported DN keys and check the sibling error for unrecognized keys.
3. Avoid trailing commas or whitespace-only tokens in the subject value.

Example fix

// before
subject: "CN=api.cluster.k8s.local,O=Example,"
// after
subject: "CN=api.cluster.k8s.local,O=Example"

for _, tok := range strings.Split(subject, ",") {
    tok = strings.TrimSpace(tok)
    if tok != "" && !strings.Contains(tok, "=") {
        return fmt.Errorf("bad DN token %q", tok)
    }
}

if err != nil { return fmt.Errorf("invalid subject %q: %w", s, err) }

When it happens

Trigger: A keypair's Subject field (from cluster spec or task config) contains a comma-separated list where at least one element lacks '=', e.g. "CN=api,O=Org,Example".

Common situations: Hand-written cluster spec subject strings, copy-pasted DN strings from other tools using different formats (e.g. slash-separated '/CN=foo'), or empty extra tokens like a trailing comma producing an empty token without '='.

Related errors

• unrecognized key %q in token %q
• parsing additional containerd config entry %q: %w
• invalid EtcdClusterSpec (expected two tokens): %q
• invalid EtcdClusterSpec (member not found in all nodes): %q
• unexpected boolean value: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/05122addcaf09e40. Report an issue: GitHub.