{"record":{"id":"82fe80be7a8582a0","repo":"kubernetes/kops","slug":"adding-encryptionconfig-secret-v","errorCode":null,"errorMessage":"adding encryptionconfig secret: %v","messagePattern":"adding encryptionconfig secret: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_secret_encryptionconfig.go","lineNumber":128,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"reading encryption config %v: %v\", options.EncryptionConfigPath, err)\n\t\t}\n\t}\n\n\tvar parsedData map[string]interface{}\n\terr = kops.ParseRawYaml(data, &parsedData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to parse YAML %v: %v\", options.EncryptionConfigPath, err)\n\t}\n\n\tsecret := &fi.Secret{\n\t\tData: data,\n\t}\n\n\tif !options.Force {\n\t\t_, created, err := secretStore.GetOrCreateSecret(ctx, \"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"adding encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif !created {\n\t\t\treturn fmt.Errorf(\"failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret\")\n\t\t}\n\t} else {\n\t\t_, err := secretStore.ReplaceSecret(\"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"updating encryptionconfig secret: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":110,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_secret_encryptionconfig.go#L110-L142","documentation":"Returned when the underlying secret store's `GetOrCreateSecret` call fails while adding the `encryptionconfig` secret. This wraps storage-layer errors (state store unreachable, permission/authorization failure, or corrupt state) — not a conflict with an existing secret, which is handled separately by the next check.","triggerScenarios":"Running `kops create secret encryptionconfig` where the state store (S3/GCS/etc.) is unreachable, credentials are missing/insufficient, the cluster state doesn't exist, or the VFS backend returns an unexpected error during create-or-get.","commonSituations":"Missing or expired cloud credentials (AWS_SESSION_TOKEN expired); wrong `--state` s3 bucket name or region; state store bucket deleted or access denied via IAM policy; network outage blocking access to the bucket.","solutions":["Verify cloud credentials are valid and have read/write access to the state store bucket (`aws s3 ls <state-store>`).","Confirm the `--state` flag / KOPS_STATE_STORE value points to an existing, correct bucket and the cluster exists (`kops get cluster <name>`).","Check network connectivity/region configuration and retry."],"exampleFix":"// before (wrong/unreachable state store)\nkops create secret encryptionconfig --state s3://wrong-bucket --name c.example.com enc.yaml\n// after\nexport KOPS_STATE_STORE=s3://my-correct-bucket\nkops create secret encryptionconfig --name c.example.com enc.yaml","handlingStrategy":"retry","validationCode":"// pre-check state store access\nconst { execSync } = require('child_process');\nexecSync(`aws s3 ls ${stateStore}/`, { stdio: 'inherit' }); // throws if unreachable/no creds","typeGuard":null,"tryCatchPattern":"try {\n  runKops(['create','secret','encryptionconfig', cluster, path]);\n} catch (e) {\n  if (/adding encryptionconfig secret/.test(e.message)) {\n    console.error('State store write failed; verify credentials/bucket and retry.');\n  }\n  throw e;\n}","preventionTips":["Verify cloud credentials before kOps runs in CI","Confirm KOPS_STATE_STORE bucket exists and is writable","Create the cluster before adding its secrets"],"tags":["cli","storage","secret","state-store","kops"],"backgroundTag":"state-store-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}