{"record":{"id":"362d2a343e72bd74","repo":"k3s-io/k3s","slug":"unsupported-secrets-encryption-provider-s","errorCode":null,"errorMessage":"unsupported secrets-encryption-provider %s","messagePattern":"unsupported secrets-encryption-provider (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/daemons/control/deps/deps.go","lineNumber":777,"sourceCode":"\tif err != nil {\n\t\treturn false\n\t}\n\treturn certutil.IsCertExpired(certificates[0], config.CertificateRenewDays)\n}\n\nfunc genEncryptionConfigAndState(controlConfig *config.Control) error {\n\truntime := controlConfig.Runtime\n\tif !controlConfig.EncryptSecrets {\n\t\treturn nil\n\t}\n\tvar keyName string\n\tswitch controlConfig.EncryptProvider {\n\tcase secretsencrypt.AESCBCProvider:\n\t\tkeyName = \"aescbckey\"\n\tcase secretsencrypt.SecretBoxProvider:\n\t\tkeyName = \"secretboxkey\"\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported secrets-encryption-provider %s\", controlConfig.EncryptProvider)\n\t}\n\tif s, err := os.Stat(runtime.EncryptionConfig); err == nil && s.Size() > 0 {\n\t\t// On upgrade from older versions, the encryption hash may not exist, create it\n\t\tif _, err := os.Stat(runtime.EncryptionHash); errors.Is(err, os.ErrNotExist) {\n\t\t\tcurEncryptionByte, err := os.ReadFile(runtime.EncryptionConfig)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tencryptionConfigHash := sha256.Sum256(curEncryptionByte)\n\t\t\tann := \"start-\" + hex.EncodeToString(encryptionConfigHash[:])\n\t\t\treturn os.WriteFile(controlConfig.Runtime.EncryptionHash, []byte(ann), 0600)\n\t\t}\n\t\treturn nil\n\t}\n\n\tkeyByte := make([]byte, secretsencrypt.KeySize)\n\tif _, err := rand.Read(keyByte); err != nil {\n\t\treturn err","sourceCodeStart":759,"sourceCodeEnd":795,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/daemons/control/deps/deps.go#L759-L795","documentation":"When secret encryption is enabled (--secrets-encryption), k3s maps EncryptProvider to a key name for the generated EncryptionConfiguration. Only two providers are supported: `aescbc` (key aescbckey) and `secretbox` (key secretboxkey). Any other string with EncryptSecrets=true fails startup before any encryption config is generated.","triggerScenarios":"Passing `--secrets-encryption-provider` a value other than aescbc or secretbox while --secrets-encryption is set (pkg/daemons/control/deps/deps.go:770-777), e.g. `aesgcm`, `kms`, `AESCBC`, or a typo like `secret-box`.","commonSituations":"Copy-paste from upstream Kubernetes Secrets EncryptionConfiguration docs, which also list aesgcm/kms; case mismatch; expecting the provider default to apply after explicitly setting a wrong value.","solutions":["Use a supported provider: `--secrets-encryption-provider secretbox` (recommended) or `--secrets-encryption-provider aescbc`.","Remove the --secrets-encryption-provider flag to fall back to the default provider selection.","Check the config file (server section) for a misspelled secrets-encryption-provider key/value pair."],"exampleFix":"# before\nk3s server --cluster-init --secrets-encryption --secrets-encryption-provider aesgcm\n\n# after\nk3s server --cluster-init --secrets-encryption --secrets-encryption-provider secretbox","handlingStrategy":"validation","validationCode":"// Whitelist providers before start:\nprovider := cfg.SecretsEncryptionProvider\nif cfg.SecretsEncryption && provider != \"aescbc\" && provider != \"secretbox\" {\n    log.Fatalf(\"unsupported secrets-encryption-provider %q (want aescbc or secretbox)\", provider)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin the provider explicitly (secretbox recommended) in version-controlled config.","Keep k3s docs, not upstream Kubernetes EncryptionConfiguration docs, as the source for supported values.","Add config validation to your deployment pipeline (kubeconform on /etc/rancher/k3s/config.yaml)."],"tags":["security","encryption","configuration","k3s"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}