{"record":{"id":"0ae7628d38d66d6a","repo":"kubernetes/kops","slug":"encryptionconfig-enabled-but-could-not-load-encry","errorCode":null,"errorMessage":"encryptionConfig enabled, but could not load encryptionconfig secret: %v","messagePattern":"encryptionConfig enabled, but could not load encryptionconfig secret: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kube_apiserver.go","lineNumber":153,"sourceCode":"\n\tif b.NodeupConfig.APIServerConfig.EncryptionConfigSecretHash != \"\" {\n\t\tencryptionConfigPath := new(filepath.Join(pathSrvKAPI, \"encryptionconfig.yaml\"))\n\n\t\tkubeAPIServer.EncryptionProviderConfig = encryptionConfigPath\n\n\t\tkey := \"encryptionconfig\"\n\t\tencryptioncfg, err := b.SecretStore.Secret(key)\n\t\tif err == nil {\n\t\t\tcontents := string(encryptioncfg.Data)\n\t\t\tt := &nodetasks.File{\n\t\t\t\tPath:     *encryptionConfigPath,\n\t\t\t\tContents: fi.NewStringResource(contents),\n\t\t\t\tMode:     new(\"600\"),\n\t\t\t\tType:     nodetasks.FileType_File,\n\t\t\t}\n\t\t\tc.AddTask(t)\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"encryptionConfig enabled, but could not load encryptionconfig secret: %v\", err)\n\t\t}\n\t}\n\n\tkubeAPIServer.ServiceAccountKeyFile = append(kubeAPIServer.ServiceAccountKeyFile, filepath.Join(pathSrvKAPI, \"service-account.pub\"))\n\tc.AddTask(&nodetasks.File{\n\t\tPath:     filepath.Join(pathSrvKAPI, \"service-account.pub\"),\n\t\tContents: fi.NewStringResource(b.NodeupConfig.APIServerConfig.ServiceAccountPublicKeys),\n\t\tType:     nodetasks.FileType_File,\n\t\tMode:     s(\"0600\"),\n\t})\n\n\t// Set the signing key if we're using Service Account Token VolumeProjection\n\tif kubeAPIServer.ServiceAccountSigningKeyFile == nil {\n\t\ts := filepath.Join(pathSrvKAPI, \"service-account.key\")\n\t\tkubeAPIServer.ServiceAccountSigningKeyFile = &s\n\t\tif err := b.BuildPrivateKeyTask(c, \"service-account\", pathSrvKAPI, \"service-account\", nil, nil); err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kube_apiserver.go#L135-L171","documentation":"Guard in the kube-apiserver builder: encryption at rest is enabled (EncryptionConfigSecretHash is set) but the 'encryptionconfig' secret could not be loaded from the secret store, so the EncryptionProviderConfig file cannot be written.","triggerScenarios":"Thrown at nodeup/pkg/model/kube_apiserver.go:153 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-create the encryption config secret (kops create secret encryptionconfig)","Check state store access from the node","Verify the secret hash matches the cluster spec"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}