{"record":{"id":"621d760697a03166","repo":"k3s-io/k3s","slug":"method-not-allowed-621d76","errorCode":null,"errorMessage":"method not allowed","messagePattern":"method not allowed","errorType":"http","errorClass":null,"httpStatus":405,"severity":"warning","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":198,"sourceCode":"\t\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if enable {\n\t\tlogrus.Infoln(\"Secrets encryption already enabled\")\n\t\treturn nil\n\t} else {\n\t\treturn errors.New(\"unable to enable/disable secrets encryption, unknown configuration\")\n\t}\n\tif err := cluster.Save(ctx, control, true); err != nil {\n\t\treturn err\n\t}\n\treturn reencryptAndRemoveKey(ctx, control, true, os.Getenv(\"NODE_NAME\"))\n}\n\nfunc EncryptionConfig(ctx context.Context, control *config.Control) http.Handler {\n\treturn http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {\n\t\tif req.Method != http.MethodPut {\n\t\t\tutil.SendError(errors.New(\"method not allowed\"), resp, req, http.StatusMethodNotAllowed)\n\t\t\treturn\n\t\t}\n\n\t\tif control.Runtime.Core == nil {\n\t\t\tutil.SendError(util.ErrCoreNotReady, resp, req, http.StatusServiceUnavailable)\n\t\t\treturn\n\t\t}\n\n\t\tencryptReq, err := getEncryptionRequest(req)\n\t\tif err != nil {\n\t\t\tutil.SendError(err, resp, req, http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tif encryptReq.Stage != nil {\n\t\t\tswitch *encryptReq.Stage {\n\t\t\tcase secretsencrypt.EncryptionPrepare:\n\t\t\t\terr = encryptionPrepare(ctx, control, encryptReq.Force)\n\t\t\tcase secretsencrypt.EncryptionRotate:","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L180-L216","documentation":"EncryptionConfig in pkg/server/handlers/secrets-encrypt.go serves /v1-k3s/encrypt-config (backing 'k3s secrets-encrypt enable/disable/rotate/prepare/reencrypt/status'). The handler accepts only HTTP PUT; anything else gets HTTP 405 'method not allowed' before the body or encryption state is examined.","triggerScenarios":"GET/POST to /v1-k3s/encrypt-config - typically curl without -X PUT, monitoring probes, or custom automation using the wrong verb.","commonSituations":"Hand-rolled scripts driving secrets encryption; Prometheus/blackbox probes that GET discovered paths.","solutions":["Issue PUT: curl -sk -X PUT -d '{\"enable\":true}' https://server:6443/v1-k3s/encrypt-config.","Prefer the CLI: 'k3s secrets-encrypt enable' / 'k3s secrets-encrypt disable', which forms the correct request.","Drop the endpoint from GET-based probing."],"exampleFix":"# before: 405\ncurl -sk https://127.0.0.1:6443/v1-k3s/encrypt-config\n\n# after: accepted\ncurl -sk -X PUT https://127.0.0.1:6443/v1-k3s/encrypt-config -d '{\"enable\":true}'","handlingStrategy":"validation","validationCode":"// Guard the verb before calling the encryption config endpoint\nif req.Method != http.MethodPut {\n    return errors.New(\"encrypt-config requires PUT\")\n}","typeGuard":null,"tryCatchPattern":"if resp.StatusCode == http.StatusMethodNotAllowed {\n    // re-send as PUT or use 'k3s secrets-encrypt enable/disable'\n}","preventionTips":["Use 'k3s secrets-encrypt' subcommands instead of raw endpoint calls.","Set -X PUT explicitly in any custom curl automation.","Keep monitoring GETs off /v1-k3s/* mutation routes."],"tags":["http","k3s","method-not-allowed","secrets-encryption"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}