{"record":{"id":"796733522e6ab41b","repo":"kubernetes/kops","slug":"could-not-load-the-ciliumpassword-secret-w","errorCode":null,"errorMessage":"could not load the ciliumpassword secret: %w","messagePattern":"could not load the ciliumpassword secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":391,"sourceCode":"\t\tsecret, err := secretStore.FindSecret(\"encryptionconfig\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have encryptionConfig enabled, but no encryptionconfig secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\")\n\t\t\treturn nil, fmt.Errorf(\"could not find encryptionconfig secret\")\n\t\t}\n\t\thashBytes := sha256.Sum256(secret.Data)\n\t\tencryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])\n\t}\n\n\tciliumSpec := c.Cluster.Spec.Networking.Cilium\n\tif ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {\n\t\tsecret, err := secretStore.FindSecret(\"ciliumpassword\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load the ciliumpassword secret: %w\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have cilium encryption enabled, but no ciliumpassword secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret ciliumpassword -h`\")\n\t\t\treturn nil, fmt.Errorf(\"could not find ciliumpassword secret\")\n\t\t}\n\t}\n\n\tproject := \"\"\n\tscwZone := \"\"\n\n\tvar sshPublicKeys [][]byte\n\t{\n\t\tkeys, err := sshCredentialStore.FindSSHPublicKeys()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error retrieving SSH public key %q: %v\", fi.SecretNameSSHPrimary, err)\n\t\t}","sourceCodeStart":373,"sourceCodeEnd":409,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L373-L409","documentation":"secretStore.FindSecret for 'ciliumpassword' returned a storage/transport error (distinct from not-found): the state store itself could not be read while Cilium IPSec encryption is enabled.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/apply_cluster.go:391 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check access to the state store (S3/GCS bucket permissions, network reachability)","Verify KOPS_STATE_STORE is set correctly and the bucket exists","Retry after resolving the state-store access issue"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}