k3s-io/k3s · error

unsupported secrets-encryption-provider %s

Error message

unsupported secrets-encryption-provider %s

What it means

When secret encryption is enabled (--secrets-encryption), k3s maps EncryptProvider to a key name for the generated EncryptionConfiguration. Only two providers are supported: `aescbc` (key aescbckey) and `secretbox` (key secretboxkey). Any other string with EncryptSecrets=true fails startup before any encryption config is generated.

Source

Thrown at pkg/daemons/control/deps/deps.go:777

	if err != nil {
		return false
	}
	return certutil.IsCertExpired(certificates[0], config.CertificateRenewDays)
}

func genEncryptionConfigAndState(controlConfig *config.Control) error {
	runtime := controlConfig.Runtime
	if !controlConfig.EncryptSecrets {
		return nil
	}
	var keyName string
	switch controlConfig.EncryptProvider {
	case secretsencrypt.AESCBCProvider:
		keyName = "aescbckey"
	case secretsencrypt.SecretBoxProvider:
		keyName = "secretboxkey"
	default:
		return fmt.Errorf("unsupported secrets-encryption-provider %s", controlConfig.EncryptProvider)
	}
	if s, err := os.Stat(runtime.EncryptionConfig); err == nil && s.Size() > 0 {
		// On upgrade from older versions, the encryption hash may not exist, create it
		if _, err := os.Stat(runtime.EncryptionHash); errors.Is(err, os.ErrNotExist) {
			curEncryptionByte, err := os.ReadFile(runtime.EncryptionConfig)
			if err != nil {
				return err
			}
			encryptionConfigHash := sha256.Sum256(curEncryptionByte)
			ann := "start-" + hex.EncodeToString(encryptionConfigHash[:])
			return os.WriteFile(controlConfig.Runtime.EncryptionHash, []byte(ann), 0600)
		}
		return nil
	}

	keyByte := make([]byte, secretsencrypt.KeySize)
	if _, err := rand.Read(keyByte); err != nil {
		return err

View on GitHub (pinned to 6ba341e396)

Solutions

1. Use a supported provider: `--secrets-encryption-provider secretbox` (recommended) or `--secrets-encryption-provider aescbc`.
2. Remove the --secrets-encryption-provider flag to fall back to the default provider selection.
3. Check the config file (server section) for a misspelled secrets-encryption-provider key/value pair.

Example fix

# before
k3s server --cluster-init --secrets-encryption --secrets-encryption-provider aesgcm

# after
k3s server --cluster-init --secrets-encryption --secrets-encryption-provider secretbox

// Whitelist providers before start:
provider := cfg.SecretsEncryptionProvider
if cfg.SecretsEncryption && provider != "aescbc" && provider != "secretbox" {
    log.Fatalf("unsupported secrets-encryption-provider %q (want aescbc or secretbox)", provider)
}

When it happens

Trigger: Passing `--secrets-encryption-provider` a value other than aescbc or secretbox while --secrets-encryption is set (pkg/daemons/control/deps/deps.go:770-777), e.g. `aesgcm`, `kms`, `AESCBC`, or a typo like `secret-box`.

Common situations: Copy-paste from upstream Kubernetes Secrets EncryptionConfiguration docs, which also list aesgcm/kms; case mismatch; expecting the provider default to apply after explicitly setting a wrong value.

Related errors

• unsupported encryption keys found
• unable to enable/disable secrets encryption, unknown configu
• critical configuration value mismatch between servers
• invalid cipher text, not : delimited
• bootstrap data already found and encrypted with different to

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/362d2a343e72bd74. Report an issue: GitHub.