{"record":{"id":"774b662f10284ea4","repo":"kubernetes/kops","slug":"reading-encryption-config-v-v","errorCode":null,"errorMessage":"reading encryption config %v: %v","messagePattern":"reading encryption config (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_secret_encryptionconfig.go","lineNumber":111,"sourceCode":"\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tsecretStore, err := clientset.SecretStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\tvar data []byte\n\tif options.EncryptionConfigPath == \"-\" {\n\t\tdata, err = ConsumeStdin()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"reading encryption config from stdin: %v\", err)\n\t\t}\n\t} else {\n\t\tdata, err = os.ReadFile(options.EncryptionConfigPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"reading encryption config %v: %v\", options.EncryptionConfigPath, err)\n\t\t}\n\t}\n\n\tvar parsedData map[string]interface{}\n\terr = kops.ParseRawYaml(data, &parsedData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to parse YAML %v: %v\", options.EncryptionConfigPath, err)\n\t}\n\n\tsecret := &fi.Secret{\n\t\tData: data,\n\t}\n\n\tif !options.Force {\n\t\t_, created, err := secretStore.GetOrCreateSecret(ctx, \"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"adding encryptionconfig secret: %v\", err)\n\t\t}","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_secret_encryptionconfig.go#L93-L129","documentation":"This error is returned by `kops create secret encryptionconfig` when `os.ReadFile` fails to read the encryption config file at `options.EncryptionConfigPath`. It wraps the underlying OS error (e.g. file-not-found, permission denied) so the user knows which path could not be read. The command needs the file's raw bytes to store as a Kubernetes encryptionconfig secret in the cluster state store.","triggerScenarios":"Running `kops create secret encryptionconfig --name <cluster> <path>` where the path passed as the positional argument does not exist, is a directory, or the process lacks read permission on it.","commonSituations":"Typos in the file path; running kOps from a different working directory with a relative path; the encryptionconfig file was deleted or renamed after generating it; SELinux/filesystem permissions blocking the read.","solutions":["Verify the file exists at the given path (`ls -l <path>`) and fix any typo or use an absolute path.","Check file permissions and ensure the user running kOps can read the file.","If passing a directory by mistake, point to the actual encryptionconfig YAML file."],"exampleFix":"// before\nkops create secret encryptionconfig --name cluster.example.com confgs/encryptionconfig.yaml\n// after\nkops create secret encryptionconfig --name cluster.example.com configs/encryptionconfig.yaml","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nif (!fs.existsSync(p) || !fs.statSync(p).isFile()) {\n  throw new Error(`encryption config file not found: ${p}`);\n}\nfs.accessSync(p, fs.constants.R_OK);","typeGuard":"function isReadableFile(p) {\n  try { return require('fs').statSync(p).isFile(); } catch { return false; }\n}","tryCatchPattern":"try {\n  runKops(['create','secret','encryptionconfig', cluster, path]);\n} catch (e) {\n  if (/reading encryption config/.test(e.message)) {\n    console.error(`Cannot read ${path}; check path and permissions.`);\n  }\n  throw e;\n}","preventionTips":["Use absolute paths in scripts/CI","Test file readability before invoking the command","Never pass a directory as the encryption config path"],"tags":["cli","filesystem","secret","kops"],"backgroundTag":"file-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}