{"record":{"id":"96849adeb1b0cd74","repo":"k3s-io/k3s","slug":"unable-to-enable-disable-secrets-encryption-unkno","errorCode":null,"errorMessage":"unable to enable/disable secrets encryption, unknown configuration","messagePattern":"unable to enable/disable secrets encryption, unknown configuration","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/server/handlers/secrets-encrypt.go","lineNumber":187,"sourceCode":"\t\t// If we find one, we can proceed.\n\t\tfor _, p := range providers[1:] {\n\t\t\tif (control.EncryptProvider == secretsencrypt.AESCBCProvider && p.AESCBC != nil) ||\n\t\t\t\t(control.EncryptProvider == secretsencrypt.SecretBoxProvider && p.Secretbox != nil) {\n\t\t\t\tfoundKey = true\n\t\t\t}\n\t\t}\n\t\tif !foundKey {\n\t\t\treturn fmt.Errorf(\"cannot enable secrets encryption with %s key type, no keys found\", control.EncryptProvider)\n\t\t}\n\t\tlogrus.Infoln(\"Enabling secrets encryption\")\n\t\tif err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else if enable {\n\t\tlogrus.Infoln(\"Secrets encryption already enabled\")\n\t\treturn nil\n\t} else {\n\t\treturn errors.New(\"unable to enable/disable secrets encryption, unknown configuration\")\n\t}\n\tif err := cluster.Save(ctx, control, true); err != nil {\n\t\treturn err\n\t}\n\treturn reencryptAndRemoveKey(ctx, control, true, os.Getenv(\"NODE_NAME\"))\n}\n\nfunc EncryptionConfig(ctx context.Context, control *config.Control) http.Handler {\n\treturn http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {\n\t\tif req.Method != http.MethodPut {\n\t\t\tutil.SendError(errors.New(\"method not allowed\"), resp, req, http.StatusMethodNotAllowed)\n\t\t\treturn\n\t\t}\n\n\t\tif control.Runtime.Core == nil {\n\t\t\tutil.SendError(util.ErrCoreNotReady, resp, req, http.StatusServiceUnavailable)\n\t\t\treturn\n\t\t}","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/secrets-encrypt.go#L169-L205","documentation":"encryptionEnable in pkg/server/handlers/secrets-encrypt.go switches on the shape of the provider list from the cluster's encryption config. The final else returns 'unable to enable/disable secrets encryption, unknown configuration' when the provider list matches none of the recognized state transitions (identity-last + AES/secretbox-first for disable, identity-first + keyed-second for enable). With the current boolean branching this branch is effectively defensive: reaching it implies a hand-edited, migrated, or corrupted encryption configuration.","triggerScenarios":"'k3s secrets-encrypt enable' or 'disable' (PUT /v1-k3s/encrypt-config) on a cluster whose /var/lib/rancher/k3s/server/cred/encryption-config.yaml has an unexpected provider order or set (e.g. manually reordered providers, only a single identity provider with enable+disable semantics bypassed, or extra providers).","commonSituations":"Editing encryption-config.yaml directly instead of via k3s CLI; restoring an old config backup; version upgrades that changed expected provider layout; config drift between nodes.","solutions":["Inspect the live config: cat /var/lib/rancher/k3s/server/cred/encryption-config.yaml and compare its provider order with a healthy cluster.","Restore a known-good encryption config from backup rather than editing in place.","Check 'k3s secrets-encrypt status' to see how k3s parses providers, and reconcile --secrets-encryption-provider with what is in the file.","As a last resort, disable encryption from a config consistent state (identity provider only) and re-enable."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Sanity-check the encryption config shape before enable/disable\nb, err := os.ReadFile(\"/var/lib/rancher/k3s/server/cred/encryption-config.yaml\")\nif err != nil {\n    return err\n}\nif !strings.Contains(string(b), \"identity\") {\n    return errors.New(\"unexpected encryption config: no identity provider; restore from backup\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unknown configuration\") {\n    // stop, diff encryption-config.yaml against a known-good backup, restore, retry\n}","preventionTips":["Manage secrets-encryption only through the k3s CLI, never by editing encryption-config.yaml.","Back up server/cred before any secrets-encryption operation.","After upgrades, verify 'k3s secrets-encrypt status' parses providers cleanly."],"tags":["k3s","secrets-encryption","configuration","security"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}