{"record":{"id":"e27b545749e5b7bc","repo":"kubernetes/kops","slug":"could-not-find-ciliumpassword-secret","errorCode":null,"errorMessage":"could not find ciliumpassword secret","messagePattern":"could not find ciliumpassword secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":397,"sourceCode":"\t\t\tfmt.Println(\"You have encryptionConfig enabled, but no encryptionconfig secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\")\n\t\t\treturn nil, fmt.Errorf(\"could not find encryptionconfig secret\")\n\t\t}\n\t\thashBytes := sha256.Sum256(secret.Data)\n\t\tencryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])\n\t}\n\n\tciliumSpec := c.Cluster.Spec.Networking.Cilium\n\tif ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {\n\t\tsecret, err := secretStore.FindSecret(\"ciliumpassword\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not load the ciliumpassword secret: %w\", err)\n\t\t}\n\t\tif secret == nil {\n\t\t\tfmt.Println(\"\")\n\t\t\tfmt.Println(\"You have cilium encryption enabled, but no ciliumpassword secret has been set.\")\n\t\t\tfmt.Println(\"See `kops create secret ciliumpassword -h`\")\n\t\t\treturn nil, fmt.Errorf(\"could not find ciliumpassword secret\")\n\t\t}\n\t}\n\n\tproject := \"\"\n\tscwZone := \"\"\n\n\tvar sshPublicKeys [][]byte\n\t{\n\t\tkeys, err := sshCredentialStore.FindSSHPublicKeys()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error retrieving SSH public key %q: %v\", fi.SecretNameSSHPrimary, err)\n\t\t}\n\n\t\tfor _, k := range keys {\n\t\t\tsshPublicKeys = append(sshPublicKeys, []byte(k.Spec.PublicKey))\n\t\t}\n\t}\n","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L379-L415","documentation":"Cilium encryption with EncryptionType=IPSec requires the 'ciliumpassword' secret (the pre-shared key), but it does not exist in the state store; kOps prints the creation command before failing.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/apply_cluster.go:397 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create the secret: `kops create secret ciliumpassword -h`","Ensure the secret is created in the same state store as the cluster"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}