{"record":{"id":"a14aaea08b8cdee4","repo":"kubernetes/kops","slug":"could-not-load-encryptionconfig-secret-v","errorCode":null,"errorMessage":"could not load encryptionconfig secret: %v","messagePattern":"could not load encryptionconfig secret: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":375,"sourceCode":"\t\tif warn {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Printf(\"%s\\n\", starline)\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilities.\")\n\t\t\tfmt.Println(\"It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'\")\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"See https://kops.sigs.k8s.io/security/#kubelet-api\")\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Printf(\"%s\\n\", starline)\n\t\t\tfmt.Println(\"\")\n\t\t}\n\t}\n\n\tencryptionConfigSecretHash := \"\"\n\tif fi.ValueOf(c.Cluster.Spec.EncryptionConfig) {\n\t\tsecret, err := secretStore.FindSecret(\"encryptionconfig\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have encryptionConfig enabled, but no encryptionconfig secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\")\n\t\t\treturn nil, fmt.Errorf(\"could not find encryptionconfig secret\")\n\t\t}\n\t\thashBytes := sha256.Sum256(secret.Data)\n\t\tencryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])\n\t}\n\n\tciliumSpec := c.Cluster.Spec.Networking.Cilium\n\tif ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {\n\t\tsecret, err := secretStore.FindSecret(\"ciliumpassword\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load the ciliumpassword secret: %w\", err)\n\t\t}\n\t\tif secret == nil {","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L357-L393","documentation":"When spec.encryptionConfig is true, Run() loads the 'encryptionconfig' secret from the keystore via secretStore.FindSecret. A non-nil error from the secret store is wrapped as this error — distinct from the case where the secret is simply missing (which prints guidance and returns 'could not find encryptionconfig secret').","triggerScenarios":"EncryptionConfig enabled on the cluster and secretStore.FindSecret(\"encryptionconfig\") errors — e.g. keystore backend (base VFS / KMS / key store in state store) unreadable due to permissions, network failure, or corrupt key-store metadata.","commonSituations":"State-store permission changes breaking reads of the keystore prefix; corrupted keystore entry for the secret; KMS/key-store backend outage; CI runner without credentials to the keystore.","solutions":["Fix access to the keystore backing store (re-authenticate cloud credentials, reapply read permissions on the secrets prefix).","Inspect the keystore object for the 'encryptionconfig' secret and restore it from backup if corrupted, then retry.","If the secret is in fact missing rather than unreadable, create it: `kops create secret encryptionconfig -f encryptionconfig.yaml` and update again."],"exampleFix":"// before\nencryptionConfig: true  # but keystore read fails with AccessDenied\n// after\n# grant read on state bucket keystore prefix, or recreate the secret:\nkops create secret encryptionconfig -f encryptionconfig.yaml\nkops update cluster ... --yes","handlingStrategy":"validation","validationCode":"if fi.ValueOf(cluster.Spec.EncryptionConfig) {\n    if _, err := secretStore.FindSecret(\"encryptionconfig\"); err != nil {\n        return fmt.Errorf(\"encryptionconfig secret unreadable: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"secret, err := secretStore.FindSecret(\"encryptionconfig\")\nif err != nil {\n    refreshCredentials()\n    secret, err = secretStore.FindSecret(\"encryptionconfig\")\n    if err != nil {\n        return fmt.Errorf(\"could not load encryptionconfig secret: %w\", err)\n    }\n}","preventionTips":["Create the secret with `kops create secret encryptionconfig -f` right after enabling EncryptionConfig.","Keep keystore permissions in the state-store bucket policy alongside other cluster prefixes.","Backup the keystore prefix and verify restore with a FindSecret smoke test."],"tags":["secrets","encryptionconfig","keystore","permissions"],"backgroundTag":"secret-store-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}