{"record":{"id":"04bb3759d2cc4752","repo":"k3s-io/k3s","slug":"unsupported-encryption-keys-found","errorCode":null,"errorMessage":"unsupported encryption keys found","messagePattern":"unsupported encryption keys found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/secretsencrypt/config.go","lineNumber":97,"sourceCode":"\t}\n\tif len(providers) > 3 {\n\t\treturn nil, fmt.Errorf(\"more than 3 providers (%d) found in secrets encryption\", len(providers))\n\t}\n\n\tfor _, p := range providers {\n\t\t// Since identity doesn't have keys, we make up a fake key to represent it, so we can\n\t\t// know that encryption is enabled/disabled in the request.\n\t\tif p.Identity != nil {\n\t\t\tcurrentKeys.Identity = true\n\t\t}\n\t\tif p.AESCBC != nil {\n\t\t\tcurrentKeys.AESCBCKeys = append(currentKeys.AESCBCKeys, p.AESCBC.Keys...)\n\t\t}\n\t\tif p.Secretbox != nil {\n\t\t\tcurrentKeys.SBKeys = append(currentKeys.SBKeys, p.Secretbox.Keys...)\n\t\t}\n\t\tif p.AESGCM != nil || p.KMS != nil {\n\t\t\treturn nil, errors.New(\"unsupported encryption keys found\")\n\t\t}\n\t}\n\treturn currentKeys, nil\n}\n\n// WriteEncryptionConfig writes the encryption configuration to the file system.\n// The provider arg will be placed first, and is used to encrypt new secrets.\nfunc WriteEncryptionConfig(runtime *config.ControlRuntime, keys *EncryptionKeys, provider string, enable bool) error {\n\tvar providers []apiserverconfigv1.ProviderConfiguration\n\tvar primary apiserverconfigv1.ProviderConfiguration\n\tvar secondary *apiserverconfigv1.ProviderConfiguration\n\tswitch provider {\n\tcase AESCBCProvider:\n\t\tprimary = apiserverconfigv1.ProviderConfiguration{\n\t\t\tAESCBC: &apiserverconfigv1.AESConfiguration{\n\t\t\t\tKeys: keys.AESCBCKeys,\n\t\t\t},\n\t\t}","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/secretsencrypt/config.go#L79-L115","documentation":"When reading the cluster's EncryptionConfiguration, getEncryptionKeys only understands the identity, aescbc, and secretbox providers. Encountering an aesgcm or kms provider means the config was created by something this code path cannot model or re-encrypt, so it refuses rather than silently dropping keys.","triggerScenarios":"Running secrets-encrypt operations (status, rotate, reencrypt) on a cluster whose EncryptionConfiguration resource or file includes an AES-CBC+GCM(aesgcm) or KMS v2 provider - typically hand-edited or applied from external tooling.","commonSituations":"Operators pasting upstream Kubernetes encryption configs that use aesgcm/kms; migration from a distribution that enabled KMS; re-enabling encryption after manually changing providers.","solutions":["Switch the EncryptionConfiguration to the supported providers: secretbox (recommended) or aescbc, keeping identity first/last as needed.","If the cluster relies on KMS/aesgcm by design, stop using the secrets-encrypt tooling for it - it will not operate those keys.","After fixing, ensure secrets are decrypted with the old provider before removing it (rotate via kubectl and verify)."],"exampleFix":"# before: EncryptionConfiguration with aesgcm/kms provider\napiVersion: apiserver.config.k8s.io/v1\nkind: EncryptionConfiguration\nresources: [ { providers: [ { aesgcm: { keys: [...] } } ] } ]\n# after\napiVersion: apiserver.config.k8s.io/v1\nkind: EncryptionConfiguration\nresources: [ { providers: [ { secretbox: { keys: [ { name: key1, secret: <32-byte-base64> } ] } } ] } ]","handlingStrategy":"validation","validationCode":"for _, p := range providers {\n    if p.AESGCM != nil || p.KMS != nil {\n        return errors.New(\"unsupported encryption provider (aesgcm/kms); use secretbox or aescbc\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on secretbox/aescbc before enabling the secrets-encrypt tooling.","Lint EncryptionConfiguration in CI against the supported provider set."],"tags":["security","encryption","kubernetes","configuration"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}