{"record":{"id":"c566c3da53ac3782","repo":"kubernetes/kops","slug":"failed-to-create-the-encryptionconfig-secret-as-it","errorCode":null,"errorMessage":"failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret","messagePattern":"failed to create the encryptionconfig secret as it already exists\\. Pass the `--force` flag to replace an existing secret","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/create_secret_encryptionconfig.go","lineNumber":131,"sourceCode":"\t}\n\n\tvar parsedData map[string]interface{}\n\terr = kops.ParseRawYaml(data, &parsedData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to parse YAML %v: %v\", options.EncryptionConfigPath, err)\n\t}\n\n\tsecret := &fi.Secret{\n\t\tData: data,\n\t}\n\n\tif !options.Force {\n\t\t_, created, err := secretStore.GetOrCreateSecret(ctx, \"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"adding encryptionconfig secret: %v\", err)\n\t\t}\n\t\tif !created {\n\t\t\treturn fmt.Errorf(\"failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret\")\n\t\t}\n\t} else {\n\t\t_, err := secretStore.ReplaceSecret(\"encryptionconfig\", secret)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"updating encryptionconfig secret: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":113,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/create_secret_encryptionconfig.go#L113-L142","documentation":"A deliberate, actionable error: `GetOrCreateSecret` returned successfully but reported the secret already existed, and `--force` was not passed. kOps refuses to silently overwrite an existing `encryptionconfig` secret, telling the user to pass `--force` to replace it.","triggerScenarios":"Running `kops create secret encryptionconfig` (without `--force`) for a cluster that already has an encryptionconfig secret in the state store; `created` is false because the secret was previously created.","commonSituations":"Re-running the create command after a first successful run (e.g. in automation/CI without idempotency handling); rotating the key but forgetting `--force`; a shared cluster where another operator already created the secret.","solutions":["Re-run with `--force` if you intentionally want to replace the existing encryptionconfig secret.","If you didn't intend to replace it, inspect the existing secret first (`kops get secret encryptionconfig --name <cluster> -oplaintext`) and skip the command.","Make automation idempotent: only run the create when the secret is absent, or always pass --force deliberately."],"exampleFix":"// before\nkops create secret encryptionconfig --name c.example.com enc.yaml\n// after\nkops create secret encryptionconfig --name c.example.com enc.yaml --force","handlingStrategy":"validation","validationCode":"// check whether the secret exists before creating\nconst out = execSync(`kops get secret encryptionconfig --name ${cluster} -oplaintext || true`).toString();\nconst exists = out.trim().length > 0;\nconst args = ['create','secret','encryptionconfig', cluster, path];\nif (exists) args.push('--force'); // deliberate replacement only","typeGuard":null,"tryCatchPattern":"try {\n  runKops(['create','secret','encryptionconfig', cluster, path]);\n} catch (e) {\n  if (/already exists/.test(e.message)) {\n    console.error('Secret exists; rerun with --force to replace intentionally.');\n  }\n  throw e;\n}","preventionTips":["Make create-secret steps idempotent (check-then-create or always --force)","Only pass --force when replacement is intentional","Document secret ownership in shared clusters"],"tags":["cli","secret","idempotency","kops"],"backgroundTag":"resource-already-exists","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}