kubernetes/kops · error

adding encryptionconfig secret: %v

Error message

adding encryptionconfig secret: %v

What it means

Returned when the underlying secret store's `GetOrCreateSecret` call fails while adding the `encryptionconfig` secret. This wraps storage-layer errors (state store unreachable, permission/authorization failure, or corrupt state) — not a conflict with an existing secret, which is handled separately by the next check.

Source

Thrown at cmd/kops/create_secret_encryptionconfig.go:128

		if err != nil {
			return fmt.Errorf("reading encryption config %v: %v", options.EncryptionConfigPath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.EncryptionConfigPath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("adding encryptionconfig secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("updating encryptionconfig secret: %v", err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify cloud credentials are valid and have read/write access to the state store bucket (`aws s3 ls <state-store>`).
2. Confirm the `--state` flag / KOPS_STATE_STORE value points to an existing, correct bucket and the cluster exists (`kops get cluster <name>`).
3. Check network connectivity/region configuration and retry.

Example fix

// before (wrong/unreachable state store)
kops create secret encryptionconfig --state s3://wrong-bucket --name c.example.com enc.yaml
// after
export KOPS_STATE_STORE=s3://my-correct-bucket
kops create secret encryptionconfig --name c.example.com enc.yaml

// pre-check state store access
const { execSync } = require('child_process');
execSync(`aws s3 ls ${stateStore}/`, { stdio: 'inherit' }); // throws if unreachable/no creds

try {
  runKops(['create','secret','encryptionconfig', cluster, path]);
} catch (e) {
  if (/adding encryptionconfig secret/.test(e.message)) {
    console.error('State store write failed; verify credentials/bucket and retry.');
  }
  throw e;
}

When it happens

Trigger: Running `kops create secret encryptionconfig` where the state store (S3/GCS/etc.) is unreachable, credentials are missing/insufficient, the cluster state doesn't exist, or the VFS backend returns an unexpected error during create-or-get.

Common situations: Missing or expired cloud credentials (AWS_SESSION_TOKEN expired); wrong `--state` s3 bucket name or region; state store bucket deleted or access denied via IAM policy; network outage blocking access to the bucket.

Related errors

• updating encryptionconfig secret: %v
• error querying cluster %q: %v
• reading encryption config %v: %v
• failed to create the encryptionconfig secret as it already e
• error adding SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/82fe80be7a8582a0. Report an issue: GitHub.