kubernetes/kops · error

could not find ciliumpassword secret

Error message

could not find ciliumpassword secret

What it means

Cilium encryption with EncryptionType=IPSec requires the 'ciliumpassword' secret (the pre-shared key), but it does not exist in the state store; kOps prints the creation command before failing.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:397

			fmt.Println("You have encryptionConfig enabled, but no encryptionconfig secret has been set.")
			fmt.Println("See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/")
			return nil, fmt.Errorf("could not find encryptionconfig secret")
		}
		hashBytes := sha256.Sum256(secret.Data)
		encryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])
	}

	ciliumSpec := c.Cluster.Spec.Networking.Cilium
	if ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {
		secret, err := secretStore.FindSecret("ciliumpassword")
		if err != nil {
			return nil, fmt.Errorf("could not load the ciliumpassword secret: %w", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have cilium encryption enabled, but no ciliumpassword secret has been set.")
			fmt.Println("See `kops create secret ciliumpassword -h`")
			return nil, fmt.Errorf("could not find ciliumpassword secret")
		}
	}

	project := ""
	scwZone := ""

	var sshPublicKeys [][]byte
	{
		keys, err := sshCredentialStore.FindSSHPublicKeys()
		if err != nil {
			return nil, fmt.Errorf("error retrieving SSH public key %q: %v", fi.SecretNameSSHPrimary, err)
		}

		for _, k := range keys {
			sshPublicKeys = append(sshPublicKeys, []byte(k.Spec.PublicKey))
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create the secret: `kops create secret ciliumpassword -h`
2. Ensure the secret is created in the same state store as the cluster

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/apply_cluster.go:397 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e27b545749e5b7bc. Report an issue: GitHub.