{"record":{"id":"3465f5ce53d45614","repo":"k3s-io/k3s","slug":"reencrypt-does-not-support-secretbox-key-type-use","errorCode":null,"errorMessage":"reencrypt does not support secretbox key type, use rotate-keys instead","messagePattern":"reencrypt does not support secretbox key type, use rotate-keys instead","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":311,"sourceCode":"\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {\n\t\treturn err\n\t}\n\tlogrus.Infof(\"Encryption %s keys right rotated\\n\", control.EncryptProvider)\n\n\tnodeName := os.Getenv(\"NODE_NAME\")\n\tif err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionRotate); err != nil {\n\t\treturn err\n\t}\n\n\treturn cluster.Save(ctx, control, true)\n}\n\nfunc encryptionReencrypt(ctx context.Context, control *config.Control, force bool, skip bool) error {\n\tif err := verifyEncryptionHashAnnotation(control.Runtime, control.Runtime.Core.Core(), secretsencrypt.EncryptionRotate); err != nil && !force {\n\t\treturn err\n\t}\n\tif control.EncryptProvider == secretsencrypt.SecretBoxProvider {\n\t\treturn errors.New(\"reencrypt does not support secretbox key type, use rotate-keys instead\")\n\t}\n\n\t// Set the reencrypt-active annotation so other nodes know we are in the process of reencrypting.\n\t// As this stage is not persisted, we do not write the annotation to file\n\tnodeName := os.Getenv(\"NODE_NAME\")\n\tif err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, true, secretsencrypt.EncryptionReencryptActive); err != nil {\n\t\treturn err\n\t}\n\n\t// We use a timeout of 10s for the reencrypt call, so finish the process as a go routine and return immediately.\n\t// No errors are returned to the user via CLI, any errors will be logged on the server\n\tgo reencryptAndRemoveKey(ctx, control, skip, nodeName)\n\treturn nil\n}\n\nfunc addAndRotateKeys(control *config.Control, keyType string) error {\n\tcurKeys, err := secretsencrypt.GetEncryptionKeys(control.Runtime)\n\tif err != nil {","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L293-L329","documentation":"encryptionReencrypt in pkg/server/handlers/secrets-encrypt.go implements the final 'reencrypt' stage (rewriting all secrets under the new key and removing the old one) and rejects SecretBox clusters with 'reencrypt does not support secretbox key type, use rotate-keys instead'. Same limitation as prepare/rotate: secretbox rotation is done via rotate-keys in one step.","triggerScenarios":"'k3s secrets-encrypt reencrypt' (or the equivalent PUT stage request) on a secretbox-provider cluster. Often encountered while unwinding a partially attempted staged rotation.","commonSituations":"Attempting the three-stage flow on default clusters; automation not branching on provider type.","solutions":["Use 'k3s secrets-encrypt rotate-keys', which re-encrypts secrets as part of secretbox key rotation.","Check 'k3s secrets-encrypt status' for a half-completed stage and complete it via rotate-keys.","Standardize automation: aescbc -> prepare/rotate/reencrypt; secretbox -> rotate-keys."],"exampleFix":"# before: rejected\nk3s secrets-encrypt reencrypt\n\n# after:\nk3s secrets-encrypt rotate-keys","handlingStrategy":"fallback","validationCode":"k3s secrets-encrypt status | grep -q secretbox && echo 'use rotate-keys, not reencrypt'","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"reencrypt does not support secretbox\") {\n    // fall back: k3s secrets-encrypt rotate-keys (re-encrypts as part of rotation)\n}","preventionTips":["One command per provider: aescbc -> staged flow, secretbox -> rotate-keys.","Check status for half-finished stages before issuing the next stage command."],"tags":["k3s","secrets-encryption","secretbox","key-rotation","unsupported-operation"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}