{"record":{"id":"1e90d052d5602e42","repo":"k3s-io/k3s","slug":"cannot-enable-secrets-encryption-with-s-key-type","errorCode":null,"errorMessage":"cannot enable secrets encryption with %s key type, no keys found","messagePattern":"cannot enable secrets encryption with (.+?) key type, no keys found","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":177,"sourceCode":"\t\tlogrus.Infoln(\"Disabling secrets encryption\")\n\t\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if !enable {\n\t\tlogrus.Infoln(\"Secrets encryption already disabled\")\n\t\treturn nil\n\t} else if providers[0].Identity != nil && (providers[1].AESCBC != nil || providers[1].Secretbox != nil) && enable {\n\t\tfoundKey := false\n\t\t// Check the rest of the providers (generally 2nd and 3rd) for the key type we are trying to enable.\n\t\t// If we find one, we can proceed.\n\t\tfor _, p := range providers[1:] {\n\t\t\tif (control.EncryptProvider == secretsencrypt.AESCBCProvider && p.AESCBC != nil) ||\n\t\t\t\t(control.EncryptProvider == secretsencrypt.SecretBoxProvider && p.Secretbox != nil) {\n\t\t\t\tfoundKey = true\n\t\t\t}\n\t\t}\n\t\tif !foundKey {\n\t\t\treturn fmt.Errorf(\"cannot enable secrets encryption with %s key type, no keys found\", control.EncryptProvider)\n\t\t}\n\t\tlogrus.Infoln(\"Enabling secrets encryption\")\n\t\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if enable {\n\t\tlogrus.Infoln(\"Secrets encryption already enabled\")\n\t\treturn nil\n\t} else {\n\t\treturn errors.New(\"unable to enable/disable secrets encryption, unknown configuration\")\n\t}\n\tif err := cluster.Save(ctx, control, true); err != nil {\n\t\treturn err\n\t}\n\treturn reencryptAndRemoveKey(ctx, control, true, os.Getenv(\"NODE_NAME\"))\n}\n\nfunc EncryptionConfig(ctx context.Context, control *config.Control) http.Handler {","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L159-L195","documentation":"Enabling secrets encryption switches the first provider from identity to a real cipher (aescbc or secretbox) chosen by --encrypt-provider / the EncryptProvider config. The existing key material in the keys file must already contain at least one key of that cipher type; k3s scans the remaining providers for a matching block and fails this check when none exists, because it never auto-generates keys on the enable path.","triggerScenarios":"'k3s secrets-encrypt enable --secretbox' when the encryption keys file only holds aescbc keys (or vice versa), or enabling with a provider whose key entries were deleted from the cred/keys file.","commonSituations":"Clusters created before secrets encryption was turned on whose default provider keys were generated for a different cipher; admins switching EncryptProvider between aescbc and secretbox without first rotating keys; key files pruned or restored from an old backup.","solutions":["Generate keys for the desired cipher first: set the provider, run 'k3s secrets-encrypt rotate-keys', then run enable.","If you meant to use the cipher whose keys already exist, enable with that provider name (aescbc vs secretbox) instead.","Verify the keys file under /var/lib/rancher/k3s/server/cred/ contains entries for the requested provider before enabling.","If keys were lost, restore the cred directory from backup before attempting enable."],"exampleFix":"# before\nk3s secrets-encrypt enable --secretbox  # only aescbc keys exist -> error\n\n# after\nk3s secrets-encrypt rotate-keys --old-cipher aescbc  # then\nk3s secrets-encrypt enable --secretbox","handlingStrategy":"validation","validationCode":"// Before enable --secretbox: confirm keys of that cipher exist in the keys file\nkeys, _ := secretsencrypt.GetEncryptionKeys(runtime)\nhasType := false\nfor _, k := range keys { if k.Type == \"secretbox\" { hasType = true } }\nif !hasType { log.Fatal(\"run rotate-keys first to generate secretbox keys\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run rotate-keys after changing the encrypt provider, before enable","Match the enable cipher to existing key material","Back up the cred directory before cipher changes"],"tags":["secrets-encryption","keys","configuration"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}