{"record":{"id":"6d33d29c174e24a1","repo":"k3s-io/k3s","slug":"prepare-does-not-support-secretbox-key-type-use-r","errorCode":null,"errorMessage":"prepare does not support secretbox key type, use rotate-keys instead","messagePattern":"prepare does not support secretbox key type, use rotate-keys instead","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":247,"sourceCode":"\t\tif err != nil {\n\t\t\tutil.SendErrorWithID(err, \"secret-encrypt\", resp, req, http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\t// If a user kills the k3s server immediately after this call, we run into issues where the files\n\t\t// have not yet been written. This sleep ensures that things have time to sync to disk before\n\t\t// the request completes.\n\t\ttime.Sleep(1 * time.Second)\n\t\tresp.WriteHeader(http.StatusOK)\n\t})\n}\n\nfunc encryptionPrepare(ctx context.Context, control *config.Control, force bool) error {\n\tstates := secretsencrypt.EncryptionStart + \"-\" + secretsencrypt.EncryptionReencryptFinished\n\tif err := verifyEncryptionHashAnnotation(control.Runtime, control.Runtime.Core.Core(), states); err != nil && !force {\n\t\treturn err\n\t}\n\tif control.EncryptProvider == secretsencrypt.SecretBoxProvider {\n\t\treturn errors.New(\"prepare does not support secretbox key type, use rotate-keys instead\")\n\t}\n\n\tcurKeys, err := secretsencrypt.GetEncryptionKeys(control.Runtime)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := AppendNewEncryptionKey(curKeys, control.EncryptProvider); err != nil {\n\t\treturn err\n\t}\n\n\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {\n\t\treturn err\n\t}\n\n\tnodeName := os.Getenv(\"NODE_NAME\")\n\tif err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionPrepare); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L229-L265","documentation":"encryptionPrepare in pkg/server/handlers/secrets-encrypt.go implements the 'prepare' stage of the two-node-upgrade secrets-encryption flow. It explicitly rejects SecretBox clusters: secretbox keys cannot be staged through the annotation-driven prepare/rotate/reencrypt sequence, so it returns guidance to use the key-rotation path instead.","triggerScenarios":"'k3s secrets-encrypt prepare' (or PUT /v1-k3s/encrypt-config with stage prepare) on a server running with --secrets-encryption-provider=secretbox (the default provider).","commonSituations":"Following the staged-rotation runbook on a default-config cluster; automation written for AES-CBC clusters run against secretbox clusters.","solutions":["Use the supported path for secretbox: 'k3s secrets-encrypt rotate-keys'.","If staged rotation is genuinely required, first plan a provider change to aes-cbc (re-encrypt), then prepare/rotate/reencrypt works.","Adjust automation to branch on 'k3s secrets-encrypt status' provider output."],"exampleFix":"# before: rejected on secretbox clusters\nk3s secrets-encrypt prepare\n\n# after: supported key rotation\nk3s secrets-encrypt rotate-keys","handlingStrategy":"fallback","validationCode":"# Branch on the actual provider before staging\nk3s secrets-encrypt status | grep -q secretbox && echo 'use rotate-keys, not prepare'","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"prepare does not support secretbox\") {\n    // fall back: k3s secrets-encrypt rotate-keys\n}","preventionTips":["Remember secretbox is the k3s default; staged rotation is aes-cbc only.","Encode the provider check into runbooks so the wrong command is never attempted."],"tags":["k3s","secrets-encryption","secretbox","key-rotation","unsupported-operation"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}