{"record":{"id":"7943c050acacd3a7","repo":"k3s-io/k3s","slug":"cannot-use-s3-config-secret-when-restoring-snapsho","errorCode":null,"errorMessage":"cannot use S3 config secret when restoring snapshot; configuration must be set in CLI or config file","messagePattern":"cannot use S3 config secret when restoring snapshot; configuration must be set in CLI or config file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/etcd/etcd.go","lineNumber":395,"sourceCode":"\t\t\t\t\treturn false, nil\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false, nil\n\t\t})\n\t}()\n\n\tif err := e.startClient(ctx); err != nil {\n\t\treturn err\n\t}\n\n\t// If asked to restore from a snapshot, do so\n\tif e.config.ClusterResetRestorePath != \"\" {\n\t\tif e.config.EtcdS3 != nil {\n\t\t\tlogrus.Infof(\"Retrieving etcd snapshot %s from S3\", e.config.ClusterResetRestorePath)\n\t\t\ts3client, err := e.getS3Client(ctx)\n\t\t\tif err != nil {\n\t\t\t\tif errors.Is(err, s3.ErrNoConfigSecret) {\n\t\t\t\t\treturn errors.New(\"cannot use S3 config secret when restoring snapshot; configuration must be set in CLI or config file\")\n\t\t\t\t}\n\t\t\t\treturn errors.WithMessage(err, \"failed to initialize S3 client\")\n\t\t\t}\n\t\t\tdir, err := snapshotDir(e.config, true)\n\t\t\tif err != nil {\n\t\t\t\treturn errors.WithMessage(err, \"failed to get the snapshot dir\")\n\t\t\t}\n\t\t\tpath, err := s3client.Download(ctx, e.config.ClusterResetRestorePath, dir)\n\t\t\tif err != nil {\n\t\t\t\treturn errors.WithMessage(err, \"failed to download snapshot from S3\")\n\t\t\t}\n\t\t\te.config.ClusterResetRestorePath = path\n\t\t\tlogrus.Infof(\"S3 download complete for %s\", e.config.ClusterResetRestorePath)\n\t\t}\n\n\t\tinfo, err := os.Stat(e.config.ClusterResetRestorePath)\n\t\tif os.IsNotExist(err) {\n\t\t\treturn fmt.Errorf(\"etcd: snapshot path does not exist: %s\", e.config.ClusterResetRestorePath)","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/etcd/etcd.go#L377-L413","documentation":"During --cluster-reset with an S3 snapshot, getS3Client returned s3.ErrNoConfigSecret: S3 credentials were configured to come from a Kubernetes secret, but at reset time no apiserver exists to read secrets from. The error mandates CLI/config-file S3 settings for restore operations.","triggerScenarios":"EtcdS3 configured with secretConfigSecret (credentials sourced from a k8s Secret) while running k3s server --cluster-reset --cluster-reset-restore-path=s3://...; the secret-retrieval path cannot execute pre-cluster.","commonSituations":"Disaster-recovery runs using the same S3-secret-based config that normal (running-cluster) snapshots used; config.yaml carries etcd-s3-secret-config-secret.","solutions":["Provide S3 credentials explicitly for the reset: --etcd-s3-access-key/--etcd-s3-secret-key (or equivalent config-file keys / env), plus bucket/endpoint/region flags, then rerun --cluster-reset.","Alternatively copy the snapshot locally and restore from the file path without S3 flags.","After the cluster is healthy again, the secret-based S3 config can be restored for routine snapshots."],"exampleFix":"# before (fails: secret cannot be read during reset)\nk3s server --cluster-reset --cluster-reset-restore-path=s3://bucket/snap --etcd-s3-secret-config-secret=s3cfg\n# after (explicit credentials)\nk3s server --cluster-reset --cluster-reset-restore-path=s3://bucket/snap \\\n  --etcd-s3-access-key=AKIA... --etcd-s3-secret-key=... --etcd-s3-bucket=bucket --etcd-s3-region=us-east-1","handlingStrategy":"validation","validationCode":"// Before a reset that uses S3, assert credentials come from flags/file, not a k8s secret:\nfunc s3ResetConfigOK(cfg Config) error {\n\tif cfg.ClusterResetRestorePath != \"\" && cfg.EtcdS3 != nil && cfg.EtcdS3.SecretConfigSecret != \"\" {\n\t\tif cfg.EtcdS3.AccessKey == \"\" || cfg.EtcdS3.SecretKey == \"\" {\n\t\t\treturn errors.New(\"supply etcd-s3 access/secret keys via flags or file for cluster-reset\")\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := e.Reset(ctx); err != nil {\n\tif strings.Contains(err.Error(), \"cannot use S3 config secret when restoring snapshot\") {\n\t\t// re-run reset with --etcd-s3-access-key/--etcd-s3-secret-key explicitly provided\n\t}\n}","preventionTips":["Maintain a separate disaster-recovery config file with explicit S3 credentials for reset operations.","Remember: anything sourced from a Kubernetes secret is unusable while the cluster is down.","Alternatively pre-download snapshots locally and restore from file paths."],"tags":["k3s","etcd","s3","cluster-reset","credentials"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}