{"record":{"id":"821a036d7c075950","repo":"kubernetes/kops","slug":"updating-encryptionconfig-secret-v","errorCode":null,"errorMessage":"updating encryptionconfig secret: %v","messagePattern":"updating encryptionconfig secret: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_secret_encryptionconfig.go","lineNumber":136,"sourceCode":"\t\treturn fmt.Errorf(\"unable to parse YAML %v: %v\", options.EncryptionConfigPath, err)\n\t}\n\n\tsecret := &fi.Secret{\n\t\tData: data,\n\t}\n\n\tif !options.Force {\n\t\t_, created, err := secretStore.GetOrCreateSecret(ctx, \"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"adding encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif !created {\n\t\t\treturn fmt.Errorf(\"failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret\")\n\t\t}\n\t} else {\n\t\t_, err := secretStore.ReplaceSecret(\"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"updating encryptionconfig secret: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":118,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_secret_encryptionconfig.go#L118-L142","documentation":"Returned when the secret store's `ReplaceSecret` fails while overwriting the `encryptionconfig` secret in `--force` mode. This wraps storage-layer errors from the state store backend (unreachable, permission denied, write conflict), meaning the replacement of the existing secret did not succeed.","triggerScenarios":"Running `kops create secret encryptionconfig --force` where the state store write fails: missing write permissions on the bucket, expired credentials, read-only bucket, or transient backend/network failure during the atomic replace.","commonSituations":"IAM policy grants read but not write on the KOPS state bucket; S3 bucket versioning/ACL conflicts; expired cloud credentials in CI; concurrent kOps runs causing a write race on the same secret.","solutions":["Verify credentials allow WRITE to the state store bucket (`aws s3 cp` a test object).","Check no concurrent kOps process is modifying the cluster and retry the command.","Confirm the bucket is not read-only / object-Lock or retention policies are not blocking overwrites."],"exampleFix":"// before: policy with only s3:GetObject on the state bucket\n// after: grant s3:PutObject on arn:aws:s3:::my-kops-bucket/* then rerun\nkops create secret encryptionconfig --name c.example.com enc.yaml --force","handlingStrategy":"retry","validationCode":"// verify write access to state store first\nexecSync(`aws s3 cp /dev/stdin ${stateStore}/.write-test` , { input: 'x', stdio: 'inherit' });","typeGuard":null,"tryCatchPattern":"try {\n  runKops(['create','secret','encryptionconfig', cluster, path, '--force']);\n} catch (e) {\n  if (/updating encryptionconfig secret/.test(e.message)) {\n    console.error('Replace failed; check bucket write perms and concurrent runs, then retry.');\n  }\n  throw e;\n}","preventionTips":["Grant s3:PutObject (or GCS equivalent) on the state bucket","Avoid concurrent kOps mutations of the same cluster","Rotate credentials before CI jobs that write secrets"],"tags":["cli","storage","secret","state-store","kops"],"backgroundTag":"state-store-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}