{"record":{"id":"4bd38d8c776f577b","repo":"kubernetes/kops","slug":"could-not-find-encryptionconfig-secret","errorCode":null,"errorMessage":"could not find encryptionconfig secret","messagePattern":"could not find encryptionconfig secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":381,"sourceCode":"\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"See https://kops.sigs.k8s.io/security/#kubelet-api\")\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Printf(\"%s\\n\", starline)\n\t\t\tfmt.Println(\"\")\n\t\t}\n\t}\n\n\tencryptionConfigSecretHash := \"\"\n\tif fi.ValueOf(c.Cluster.Spec.EncryptionConfig) {\n\t\tsecret, err := secretStore.FindSecret(\"encryptionconfig\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have encryptionConfig enabled, but no encryptionconfig secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\")\n\t\t\treturn nil, fmt.Errorf(\"could not find encryptionconfig secret\")\n\t\t}\n\t\thashBytes := sha256.Sum256(secret.Data)\n\t\tencryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])\n\t}\n\n\tciliumSpec := c.Cluster.Spec.Networking.Cilium\n\tif ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {\n\t\tsecret, err := secretStore.FindSecret(\"ciliumpassword\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load the ciliumpassword secret: %w\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have cilium encryption enabled, but no ciliumpassword secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret ciliumpassword -h`\")\n\t\t\treturn nil, fmt.Errorf(\"could not find ciliumpassword secret\")\n\t\t}\n\t}","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L363-L399","documentation":"Secret-based encryption at rest (spec.encryptionConfig enabled) requires the 'encryptionconfig' secret, which holds the EncryptionConfiguration; the secret store lookup returned nil, meaning it was never created for this cluster.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/apply_cluster.go:381 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create the secret: `kops create secret encryptionconfig -h` and follow the examples","If migrating from an existing cluster, copy the previous encryptionconfig secret so existing data remains decryptable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}