reencrypt does not support secretbox key type, use rotate-ke

Error message

reencrypt does not support secretbox key type, use rotate-keys instead

What it means

encryptionReencrypt in pkg/server/handlers/secrets-encrypt.go implements the final 'reencrypt' stage (rewriting all secrets under the new key and removing the old one) and rejects SecretBox clusters with 'reencrypt does not support secretbox key type, use rotate-keys instead'. Same limitation as prepare/rotate: secretbox rotation is done via rotate-keys in one step.

Source

Thrown at pkg/server/handlers/secrets-encrypt.go:311

	if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
		return err
	}
	logrus.Infof("Encryption %s keys right rotated\n", control.EncryptProvider)

	nodeName := os.Getenv("NODE_NAME")
	if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionRotate); err != nil {
		return err
	}

	return cluster.Save(ctx, control, true)
}

func encryptionReencrypt(ctx context.Context, control *config.Control, force bool, skip bool) error {
	if err := verifyEncryptionHashAnnotation(control.Runtime, control.Runtime.Core.Core(), secretsencrypt.EncryptionRotate); err != nil && !force {
		return err
	}
	if control.EncryptProvider == secretsencrypt.SecretBoxProvider {
		return errors.New("reencrypt does not support secretbox key type, use rotate-keys instead")
	}

	// Set the reencrypt-active annotation so other nodes know we are in the process of reencrypting.
	// As this stage is not persisted, we do not write the annotation to file
	nodeName := os.Getenv("NODE_NAME")
	if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, true, secretsencrypt.EncryptionReencryptActive); err != nil {
		return err
	}

	// We use a timeout of 10s for the reencrypt call, so finish the process as a go routine and return immediately.
	// No errors are returned to the user via CLI, any errors will be logged on the server
	go reencryptAndRemoveKey(ctx, control, skip, nodeName)
	return nil
}

func addAndRotateKeys(control *config.Control, keyType string) error {
	curKeys, err := secretsencrypt.GetEncryptionKeys(control.Runtime)
	if err != nil {

View on GitHub (pinned to 6ba341e396)

Solutions

Use 'k3s secrets-encrypt rotate-keys', which re-encrypts secrets as part of secretbox key rotation.
Check 'k3s secrets-encrypt status' for a half-completed stage and complete it via rotate-keys.
Standardize automation: aescbc -> prepare/rotate/reencrypt; secretbox -> rotate-keys.

Example fix

# before: rejected
k3s secrets-encrypt reencrypt

# after:
k3s secrets-encrypt rotate-keys

Defensive patterns

Strategy: fallback

Validate before calling

k3s secrets-encrypt status | grep -q secretbox && echo 'use rotate-keys, not reencrypt'

Try / catch

if err != nil && strings.Contains(err.Error(), "reencrypt does not support secretbox") {
    // fall back: k3s secrets-encrypt rotate-keys (re-encrypts as part of rotation)
}

Prevention

One command per provider: aescbc -> staged flow, secretbox -> rotate-keys.
Check status for half-finished stages before issuing the next stage command.

When it happens

Trigger: 'k3s secrets-encrypt reencrypt' (or the equivalent PUT stage request) on a secretbox-provider cluster. Often encountered while unwinding a partially attempted staged rotation.

Common situations: Attempting the three-stage flow on default clusters; automation not branching on provider type.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/3465f5ce53d45614. Report an issue: GitHub.