kubernetes/kops · error

could not find encryptionconfig secret

Error message

could not find encryptionconfig secret

What it means

Secret-based encryption at rest (spec.encryptionConfig enabled) requires the 'encryptionconfig' secret, which holds the EncryptionConfiguration; the secret store lookup returned nil, meaning it was never created for this cluster.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:381

			fmt.Println("")
			fmt.Println("See https://kops.sigs.k8s.io/security/#kubelet-api")
			fmt.Println("")
			fmt.Printf("%s\n", starline)
			fmt.Println("")
		}
	}

	encryptionConfigSecretHash := ""
	if fi.ValueOf(c.Cluster.Spec.EncryptionConfig) {
		secret, err := secretStore.FindSecret("encryptionconfig")
		if err != nil {
			return nil, fmt.Errorf("could not load encryptionconfig secret: %v", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have encryptionConfig enabled, but no encryptionconfig secret has been set.")
			fmt.Println("See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/")
			return nil, fmt.Errorf("could not find encryptionconfig secret")
		}
		hashBytes := sha256.Sum256(secret.Data)
		encryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])
	}

	ciliumSpec := c.Cluster.Spec.Networking.Cilium
	if ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {
		secret, err := secretStore.FindSecret("ciliumpassword")
		if err != nil {
			return nil, fmt.Errorf("could not load the ciliumpassword secret: %w", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have cilium encryption enabled, but no ciliumpassword secret has been set.")
			fmt.Println("See `kops create secret ciliumpassword -h`")
			return nil, fmt.Errorf("could not find ciliumpassword secret")
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create the secret: `kops create secret encryptionconfig -h` and follow the examples
2. If migrating from an existing cluster, copy the previous encryptionconfig secret so existing data remains decryptable

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/apply_cluster.go:381 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4bd38d8c776f577b. Report an issue: GitHub.