kubernetes/kops · error

could not load encryptionconfig secret: %v

Error message

could not load encryptionconfig secret: %v

What it means

When spec.encryptionConfig is true, Run() loads the 'encryptionconfig' secret from the keystore via secretStore.FindSecret. A non-nil error from the secret store is wrapped as this error — distinct from the case where the secret is simply missing (which prints guidance and returns 'could not find encryptionconfig secret').

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:375

		if warn {
			fmt.Println("")
			fmt.Printf("%s\n", starline)
			fmt.Println("")
			fmt.Println("Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilities.")
			fmt.Println("It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'")
			fmt.Println("")
			fmt.Println("See https://kops.sigs.k8s.io/security/#kubelet-api")
			fmt.Println("")
			fmt.Printf("%s\n", starline)
			fmt.Println("")
		}
	}

	encryptionConfigSecretHash := ""
	if fi.ValueOf(c.Cluster.Spec.EncryptionConfig) {
		secret, err := secretStore.FindSecret("encryptionconfig")
		if err != nil {
			return nil, fmt.Errorf("could not load encryptionconfig secret: %v", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have encryptionConfig enabled, but no encryptionconfig secret has been set.")
			fmt.Println("See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/")
			return nil, fmt.Errorf("could not find encryptionconfig secret")
		}
		hashBytes := sha256.Sum256(secret.Data)
		encryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])
	}

	ciliumSpec := c.Cluster.Spec.Networking.Cilium
	if ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {
		secret, err := secretStore.FindSecret("ciliumpassword")
		if err != nil {
			return nil, fmt.Errorf("could not load the ciliumpassword secret: %w", err)
		}
		if secret == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix access to the keystore backing store (re-authenticate cloud credentials, reapply read permissions on the secrets prefix).
2. Inspect the keystore object for the 'encryptionconfig' secret and restore it from backup if corrupted, then retry.
3. If the secret is in fact missing rather than unreadable, create it: `kops create secret encryptionconfig -f encryptionconfig.yaml` and update again.

Example fix

// before
encryptionConfig: true  # but keystore read fails with AccessDenied
// after
# grant read on state bucket keystore prefix, or recreate the secret:
kops create secret encryptionconfig -f encryptionconfig.yaml
kops update cluster ... --yes

if fi.ValueOf(cluster.Spec.EncryptionConfig) {
    if _, err := secretStore.FindSecret("encryptionconfig"); err != nil {
        return fmt.Errorf("encryptionconfig secret unreadable: %w", err)
    }
}

secret, err := secretStore.FindSecret("encryptionconfig")
if err != nil {
    refreshCredentials()
    secret, err = secretStore.FindSecret("encryptionconfig")
    if err != nil {
        return fmt.Errorf("could not load encryptionconfig secret: %w", err)
    }
}

When it happens

Trigger: EncryptionConfig enabled on the cluster and secretStore.FindSecret("encryptionconfig") errors — e.g. keystore backend (base VFS / KMS / key store in state store) unreadable due to permissions, network failure, or corrupt key-store metadata.

Common situations: State-store permission changes breaking reads of the keystore prefix; corrupted keystore entry for the secret; KMS/key-store backend outage; CI runner without credentials to the keystore.

Related errors

• writing keyset: %v
• error writing secret to %q: %v
• unknown CA %q
• server-side client does not support StoreKeyset
• server-side client does not support MirrorTo

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a14aaea08b8cdee4. Report an issue: GitHub.