k3s-io/k3s · warning

method not allowed

Error message

method not allowed

What it means

EncryptionConfig in pkg/server/handlers/secrets-encrypt.go serves /v1-k3s/encrypt-config (backing 'k3s secrets-encrypt enable/disable/rotate/prepare/reencrypt/status'). The handler accepts only HTTP PUT; anything else gets HTTP 405 'method not allowed' before the body or encryption state is examined.

Source

Thrown at pkg/server/handlers/secrets-encrypt.go:198

		if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {
			return err
		}
	} else if enable {
		logrus.Infoln("Secrets encryption already enabled")
		return nil
	} else {
		return errors.New("unable to enable/disable secrets encryption, unknown configuration")
	}
	if err := cluster.Save(ctx, control, true); err != nil {
		return err
	}
	return reencryptAndRemoveKey(ctx, control, true, os.Getenv("NODE_NAME"))
}

func EncryptionConfig(ctx context.Context, control *config.Control) http.Handler {
	return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
		if req.Method != http.MethodPut {
			util.SendError(errors.New("method not allowed"), resp, req, http.StatusMethodNotAllowed)
			return
		}

		if control.Runtime.Core == nil {
			util.SendError(util.ErrCoreNotReady, resp, req, http.StatusServiceUnavailable)
			return
		}

		encryptReq, err := getEncryptionRequest(req)
		if err != nil {
			util.SendError(err, resp, req, http.StatusBadRequest)
			return
		}
		if encryptReq.Stage != nil {
			switch *encryptReq.Stage {
			case secretsencrypt.EncryptionPrepare:
				err = encryptionPrepare(ctx, control, encryptReq.Force)
			case secretsencrypt.EncryptionRotate:

View on GitHub (pinned to 6ba341e396)

Solutions

1. Issue PUT: curl -sk -X PUT -d '{"enable":true}' https://server:6443/v1-k3s/encrypt-config.
2. Prefer the CLI: 'k3s secrets-encrypt enable' / 'k3s secrets-encrypt disable', which forms the correct request.
3. Drop the endpoint from GET-based probing.

Example fix

# before: 405
curl -sk https://127.0.0.1:6443/v1-k3s/encrypt-config

# after: accepted
curl -sk -X PUT https://127.0.0.1:6443/v1-k3s/encrypt-config -d '{"enable":true}'

// Guard the verb before calling the encryption config endpoint
if req.Method != http.MethodPut {
    return errors.New("encrypt-config requires PUT")
}

if resp.StatusCode == http.StatusMethodNotAllowed {
    // re-send as PUT or use 'k3s secrets-encrypt enable/disable'
}

When it happens

Trigger: GET/POST to /v1-k3s/encrypt-config - typically curl without -X PUT, monitoring probes, or custom automation using the wrong verb.

Common situations: Hand-rolled scripts driving secrets encryption; Prometheus/blackbox probes that GET discovered paths.

Related errors

• method not allowed
• method not allowed
• etcd datastore disabled
• hijacking not supported
• not authorized

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/621d760697a03166. Report an issue: GitHub.