cilium/cilium · error

failed to create IPsec key: %w

Error message

failed to create IPsec key: %w

What it means

IPsecNewKey wraps any failure from createIPsecKey, the function that generates a new random IPsec key for the configured authentication algorithm. The wrapped error indicates key generation itself failed (not secret creation or existence checks).

Source

Thrown at cilium-cli/encrypt/ipsec_new_key.go:28

	corev1 "k8s.io/api/core/v1"
	k8sErrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"github.com/cilium/cilium/cilium-cli/defaults"
)

func (s *Encrypt) IPsecNewKey(ctx context.Context) error {
	ctx, cancelFn := context.WithTimeout(ctx, s.params.WaitDuration)
	defer cancelFn()

	if err := s.checkEncryptionSecretNotExists(ctx); err != nil {
		return err
	}

	newKey, err := createIPsecKey(s.params.IPsecKeyAuthAlgo)
	if err != nil {
		return fmt.Errorf("failed to create IPsec key: %w", err)
	}

	if err := s.createEncryptionSecret(ctx, newKey); err != nil {
		return err
	}

	fmt.Printf("IPsec key successfully created, new key SPI: %d\n", newKey.spi)
	return nil
}

func (s *Encrypt) checkEncryptionSecretNotExists(ctx context.Context) error {
	_, err := s.client.GetSecret(ctx, s.params.CiliumNamespace, defaults.EncryptionSecretName, metav1.GetOptions{})
	if err == nil {
		return errors.New("IPsec secret already exists, rotate key if needed using `cilium encryption rotate-key` command")
	}
	if !k8sErrors.IsNotFound(err) {
		return fmt.Errorf("failed to check if IPsec secret exists: %w", err)
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the --ipsec-key-auth-algo flag value; use a supported algorithm (e.g. gcm-aes)
2. Read the wrapped error for the root cause and fix that condition
3. Retry the command; key generation is side-effect free until the secret is created

Example fix

// before
cilium encryption create-key --ipsec-key-auth-algo bogus
// after
cilium encryption create-key --ipsec-key-auth-algo gcm-aes

const supported = ['gcm-aes'] // check rotators registry
if (!supported.includes(args.ipsecKeyAuthAlgo)) throw new Error(`unsupported algo: ${args.ipsecKeyAuthAlgo}`)

function isSupportedAlgo(a) { return typeof a === 'string' && ['gcm-aes'].includes(a) }

try { await IPsecNewKey(ctx) } catch (err) { if (/failed to create IPsec key/.test(err.message)) { log('key generation failed:', err.cause) } else throw err }

When it happens

Trigger: Running 'cilium encryption create-key' (IPsecNewKey) where createIPsecKey(s.params.IPsecKeyAuthAlgo) returns an error — e.g. rotators lookup/dispatch failing for the given algo or the underlying generator erroring.

Common situations: Passing an unsupported --ipsec-key-auth-algo value with no registered rotator; environment entropy issues in constrained CI containers.

Related errors

• an unsupported XfrmStateAlgo combination has been found
• BIG TCP is not supported with encryption enabled
• failed to unmarshal bgp state from %s: %w
• failed to fetch bgp state from %s: (%s)
• failed to unmarshal bgp routes from %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/5658e7b7f58bc072. Report an issue: GitHub.