rotate does not support secretbox key type, use rotate-keys

Error message

rotate does not support secretbox key type, use rotate-keys instead

What it means

encryptionRotate in pkg/server/handlers/secrets-encrypt.go implements the 'rotate' stage (moving the new key into first position) and rejects SecretBox clusters with 'rotate does not support secretbox key type, use rotate-keys instead'. Secretbox key sets are rotated atomically by regenerating them, not by reordering staged providers.

Source

Thrown at pkg/server/handlers/secrets-encrypt.go:275

	if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
		return err
	}

	nodeName := os.Getenv("NODE_NAME")
	if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionPrepare); err != nil {
		return err
	}

	return cluster.Save(ctx, control, true)
}

func encryptionRotate(ctx context.Context, control *config.Control, force bool) error {
	if err := verifyEncryptionHashAnnotation(control.Runtime, control.Runtime.Core.Core(), secretsencrypt.EncryptionPrepare); err != nil && !force {
		return err
	}
	if control.EncryptProvider == secretsencrypt.SecretBoxProvider {
		return errors.New("rotate does not support secretbox key type, use rotate-keys instead")
	}

	curKeys, err := secretsencrypt.GetEncryptionKeys(control.Runtime)
	if err != nil {
		return err
	}

	// Right rotate selected keys
	switch control.EncryptProvider {
	case secretsencrypt.AESCBCProvider:
		rotatedKeys := append(curKeys.AESCBCKeys[len(curKeys.AESCBCKeys)-1:], curKeys.AESCBCKeys[:len(curKeys.AESCBCKeys)-1]...)
		curKeys.AESCBCKeys = rotatedKeys
	case secretsencrypt.SecretBoxProvider:
		rotatedKeys := append(curKeys.SBKeys[len(curKeys.SBKeys)-1:], curKeys.SBKeys[:len(curKeys.SBKeys)-1]...)
		curKeys.SBKeys = rotatedKeys
	}

	if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {

View on GitHub (pinned to 6ba341e396)

Solutions

Use 'k3s secrets-encrypt rotate-keys' for secretbox clusters.
Gate automation on the provider reported by 'k3s secrets-encrypt status'.
Consider aes-cbc via --secrets-encryption-provider=aescbc if staged rotation is a hard requirement.

Example fix

# before: rejected
k3s secrets-encrypt rotate

# after:
k3s secrets-encrypt rotate-keys

Defensive patterns

Strategy: fallback

Validate before calling

k3s secrets-encrypt status | grep -q secretbox && echo 'use rotate-keys, not rotate'

Try / catch

if err != nil && strings.Contains(err.Error(), "rotate does not support secretbox") {
    // fall back: k3s secrets-encrypt rotate-keys
}

Prevention

For secretbox clusters, rotate-keys replaces the whole prepare/rotate/reencrypt sequence.
Automate provider detection before choosing the rotation command.

When it happens

Trigger: 'k3s secrets-encrypt rotate' on a cluster whose encryption provider is secretbox (the k3s default), i.e. after a prepare attempt or by directly invoking the stage.

Common situations: Runbooks for AES-CBC copied to default clusters; CI executing the staged flow regardless of provider.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/1e4c3315d4c72481. Report an issue: GitHub.