unable to enable/disable secrets encryption, unknown configu

Error message

unable to enable/disable secrets encryption, unknown configuration

What it means

encryptionEnable in pkg/server/handlers/secrets-encrypt.go switches on the shape of the provider list from the cluster's encryption config. The final else returns 'unable to enable/disable secrets encryption, unknown configuration' when the provider list matches none of the recognized state transitions (identity-last + AES/secretbox-first for disable, identity-first + keyed-second for enable). With the current boolean branching this branch is effectively defensive: reaching it implies a hand-edited, migrated, or corrupted encryption configuration.

Source

Thrown at pkg/server/handlers/secrets-encrypt.go:187

		// If we find one, we can proceed.
		for _, p := range providers[1:] {
			if (control.EncryptProvider == secretsencrypt.AESCBCProvider && p.AESCBC != nil) ||
				(control.EncryptProvider == secretsencrypt.SecretBoxProvider && p.Secretbox != nil) {
				foundKey = true
			}
		}
		if !foundKey {
			return fmt.Errorf("cannot enable secrets encryption with %s key type, no keys found", control.EncryptProvider)
		}
		logrus.Infoln("Enabling secrets encryption")
		if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, enable); err != nil {
			return err
		}
	} else if enable {
		logrus.Infoln("Secrets encryption already enabled")
		return nil
	} else {
		return errors.New("unable to enable/disable secrets encryption, unknown configuration")
	}
	if err := cluster.Save(ctx, control, true); err != nil {
		return err
	}
	return reencryptAndRemoveKey(ctx, control, true, os.Getenv("NODE_NAME"))
}

func EncryptionConfig(ctx context.Context, control *config.Control) http.Handler {
	return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
		if req.Method != http.MethodPut {
			util.SendError(errors.New("method not allowed"), resp, req, http.StatusMethodNotAllowed)
			return
		}

		if control.Runtime.Core == nil {
			util.SendError(util.ErrCoreNotReady, resp, req, http.StatusServiceUnavailable)
			return
		}

View on GitHub (pinned to 6ba341e396)

Solutions

Inspect the live config: cat /var/lib/rancher/k3s/server/cred/encryption-config.yaml and compare its provider order with a healthy cluster.
Restore a known-good encryption config from backup rather than editing in place.
Check 'k3s secrets-encrypt status' to see how k3s parses providers, and reconcile --secrets-encryption-provider with what is in the file.
As a last resort, disable encryption from a config consistent state (identity provider only) and re-enable.

Defensive patterns

Strategy: validation

Validate before calling

// Sanity-check the encryption config shape before enable/disable
b, err := os.ReadFile("/var/lib/rancher/k3s/server/cred/encryption-config.yaml")
if err != nil {
    return err
}
if !strings.Contains(string(b), "identity") {
    return errors.New("unexpected encryption config: no identity provider; restore from backup")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "unknown configuration") {
    // stop, diff encryption-config.yaml against a known-good backup, restore, retry
}

Prevention

Manage secrets-encryption only through the k3s CLI, never by editing encryption-config.yaml.
Back up server/cred before any secrets-encryption operation.
After upgrades, verify 'k3s secrets-encrypt status' parses providers cleanly.

When it happens

Trigger: 'k3s secrets-encrypt enable' or 'disable' (PUT /v1-k3s/encrypt-config) on a cluster whose /var/lib/rancher/k3s/server/cred/encryption-config.yaml has an unexpected provider order or set (e.g. manually reordered providers, only a single identity provider with enable+disable semantics bypassed, or extra providers).

Common situations: Editing encryption-config.yaml directly instead of via k3s CLI; restoring an old config backup; version upgrades that changed expected provider layout; config drift between nodes.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/96849adeb1b0cd74. Report an issue: GitHub.