{"record":{"id":"78dcf10e975353ed","repo":"kubernetes/kops","slug":"secretstore-not-set","errorCode":null,"errorMessage":"SecretStore not set","messagePattern":"SecretStore not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":226,"sourceCode":"\t\tNodeupConfig: &nodeupConfig,\n\t}\n\n\tvar secretStore fi.SecretStoreReader\n\tvar keyStore fi.KeystoreReader\n\tswitch {\n\tcase nodeConfig != nil:\n\t\tmodelContext.SecretStore = configserver.NewSecretStore(nodeConfig.NodeSecrets)\n\tcase nodeupConfig.ConfigStore != nil && nodeupConfig.ConfigStore.Secrets != \"\":\n\t\tklog.Infof(\"Building SecretStore at %q\", nodeupConfig.ConfigStore.Secrets)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building secret store path: %v\", err)\n\t\t}\n\n\t\tsecretStore = secrets.NewVFSSecretStoreReader(p)\n\t\tmodelContext.SecretStore = secretStore\n\tdefault:\n\t\treturn fmt.Errorf(\"SecretStore not set\")\n\t}\n\n\tif nodeConfig != nil {\n\t\tmodelContext.KeyStore = configserver.NewKeyStore()\n\t} else if nodeupConfig.ConfigStore.Keypairs != \"\" {\n\t\tklog.Infof(\"Building KeyStore at %q\", nodeupConfig.ConfigStore.Keypairs)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building key store path: %v\", err)\n\t\t}\n\n\t\tmodelContext.KeyStore = fi.NewVFSKeystoreReader(p)\n\t\tkeyStore = modelContext.KeyStore\n\t} else {\n\t\treturn fmt.Errorf(\"KeyStore not set\")\n\t}\n\n\tif err := modelContext.Init(); err != nil {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L208-L244","documentation":"nodeup requires a source for cluster secrets (TLS material, passwords). If no config-server NodeConfig is present, it looks for nodeupConfig.ConfigStore.Secrets; when ConfigStore is nil or Secrets is empty, the switch falls to default and Run returns this error. Without a SecretStore, nodeup cannot provision k8s secrets on the node.","triggerScenarios":"Running NodeUpCommand.Run() in VFS mode where nodeupConfig.ConfigStore is nil or ConfigStore.Secrets == \"\" and nodeConfig == nil — i.e. the parsed nodeupconfig.yaml lacks the configStore.secrets field entirely.","commonSituations":"Older kOps state stores whose nodeupconfig.yaml predates the ConfigStore field; hand-trimmed or corrupted nodeupconfig.yaml; configs generated for config-server mode but booted via VFS (or vice versa), leaving the field empty.","solutions":["Re-run 'kops update cluster --yes' with the current kOps version so nodeupconfig.yaml includes the configStore.secrets path.","Add the secrets path to the cluster spec (configStore.secrets, e.g. s3://bucket/cluster/secrets) and re-apply.","Verify the node is configured for the right mode: if you intend config-server mode, set bootConfig.ConfigServer.Servers; otherwise ensure VFS ConfigStore is populated.","Compare nodeupconfig.yaml in the state store against a fresh cluster's file to spot missing fields from schema drift after a kOps upgrade."],"exampleFix":"// before (nodeupconfig.yaml)\nconfigStore: {}\n// after\nconfigStore:\n  secrets: s3://bucket/cluster.k8s.local/secrets\n  keypairs: s3://bucket/cluster.k8s.local/pki","handlingStrategy":"validation","validationCode":"// Require a secret store source before invoking nodeup\nif nodeConfig == nil && (cfg.ConfigStore == nil || cfg.ConfigStore.Secrets == \"\") {\n    return fmt.Errorf(\"configStore.secrets must be set (or use ConfigServer mode)\")\n}","typeGuard":null,"tryCatchPattern":"err := cmd.Run(out)\nif err != nil && strings.Contains(err.Error(), \"SecretStore not set\") {\n    // regenerate nodeupconfig.yaml via kops update cluster\n}","preventionTips":["Keep kOps versions in sync between control plane config generation and nodeup","Always run 'kops update cluster --yes' after upgrading kOps before replacing nodes","Validate nodeupconfig.yaml contains configStore.secrets before node boot"],"tags":["nodeup","secretstore","missing-config","bootstrap"],"backgroundTag":"missing-required-config-field","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}