{"record":{"id":"1e4c3315d4c72481","repo":"k3s-io/k3s","slug":"rotate-does-not-support-secretbox-key-type-use-ro","errorCode":null,"errorMessage":"rotate does not support secretbox key type, use rotate-keys instead","messagePattern":"rotate does not support secretbox key type, use rotate-keys instead","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":275,"sourceCode":"\n\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {\n\t\treturn err\n\t}\n\n\tnodeName := os.Getenv(\"NODE_NAME\")\n\tif err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionPrepare); err != nil {\n\t\treturn err\n\t}\n\n\treturn cluster.Save(ctx, control, true)\n}\n\nfunc encryptionRotate(ctx context.Context, control *config.Control, force bool) error {\n\tif err := verifyEncryptionHashAnnotation(control.Runtime, control.Runtime.Core.Core(), secretsencrypt.EncryptionPrepare); err != nil && !force {\n\t\treturn err\n\t}\n\tif control.EncryptProvider == secretsencrypt.SecretBoxProvider {\n\t\treturn errors.New(\"rotate does not support secretbox key type, use rotate-keys instead\")\n\t}\n\n\tcurKeys, err := secretsencrypt.GetEncryptionKeys(control.Runtime)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Right rotate selected keys\n\tswitch control.EncryptProvider {\n\tcase secretsencrypt.AESCBCProvider:\n\t\trotatedKeys := append(curKeys.AESCBCKeys[len(curKeys.AESCBCKeys)-1:], curKeys.AESCBCKeys[:len(curKeys.AESCBCKeys)-1]...)\n\t\tcurKeys.AESCBCKeys = rotatedKeys\n\tcase secretsencrypt.SecretBoxProvider:\n\t\trotatedKeys := append(curKeys.SBKeys[len(curKeys.SBKeys)-1:], curKeys.SBKeys[:len(curKeys.SBKeys)-1]...)\n\t\tcurKeys.SBKeys = rotatedKeys\n\t}\n\n\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L257-L293","documentation":"encryptionRotate in pkg/server/handlers/secrets-encrypt.go implements the 'rotate' stage (moving the new key into first position) and rejects SecretBox clusters with 'rotate does not support secretbox key type, use rotate-keys instead'. Secretbox key sets are rotated atomically by regenerating them, not by reordering staged providers.","triggerScenarios":"'k3s secrets-encrypt rotate' on a cluster whose encryption provider is secretbox (the k3s default), i.e. after a prepare attempt or by directly invoking the stage.","commonSituations":"Runbooks for AES-CBC copied to default clusters; CI executing the staged flow regardless of provider.","solutions":["Use 'k3s secrets-encrypt rotate-keys' for secretbox clusters.","Gate automation on the provider reported by 'k3s secrets-encrypt status'.","Consider aes-cbc via --secrets-encryption-provider=aescbc if staged rotation is a hard requirement."],"exampleFix":"# before: rejected\nk3s secrets-encrypt rotate\n\n# after:\nk3s secrets-encrypt rotate-keys","handlingStrategy":"fallback","validationCode":"k3s secrets-encrypt status | grep -q secretbox && echo 'use rotate-keys, not rotate'","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"rotate does not support secretbox\") {\n    // fall back: k3s secrets-encrypt rotate-keys\n}","preventionTips":["For secretbox clusters, rotate-keys replaces the whole prepare/rotate/reencrypt sequence.","Automate provider detection before choosing the rotation command."],"tags":["k3s","secrets-encryption","secretbox","key-rotation","unsupported-operation"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}