kubernetes/kops · error

could not load the ciliumpassword secret: %w

Error message

could not load the ciliumpassword secret: %w

What it means

secretStore.FindSecret for 'ciliumpassword' returned a storage/transport error (distinct from not-found): the state store itself could not be read while Cilium IPSec encryption is enabled.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:391

		secret, err := secretStore.FindSecret("encryptionconfig")
		if err != nil {
			return nil, fmt.Errorf("could not load encryptionconfig secret: %v", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have encryptionConfig enabled, but no encryptionconfig secret has been set.")
			fmt.Println("See `kops create secret encryptionconfig -h` and https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/")
			return nil, fmt.Errorf("could not find encryptionconfig secret")
		}
		hashBytes := sha256.Sum256(secret.Data)
		encryptionConfigSecretHash = base64.URLEncoding.EncodeToString(hashBytes[:])
	}

	ciliumSpec := c.Cluster.Spec.Networking.Cilium
	if ciliumSpec != nil && ciliumSpec.EnableEncryption && ciliumSpec.EncryptionType == kops.CiliumEncryptionTypeIPSec {
		secret, err := secretStore.FindSecret("ciliumpassword")
		if err != nil {
			return nil, fmt.Errorf("could not load the ciliumpassword secret: %w", err)
		}
		if secret == nil {
			fmt.Println("")
			fmt.Println("You have cilium encryption enabled, but no ciliumpassword secret has been set.")
			fmt.Println("See `kops create secret ciliumpassword -h`")
			return nil, fmt.Errorf("could not find ciliumpassword secret")
		}
	}

	project := ""
	scwZone := ""

	var sshPublicKeys [][]byte
	{
		keys, err := sshCredentialStore.FindSSHPublicKeys()
		if err != nil {
			return nil, fmt.Errorf("error retrieving SSH public key %q: %v", fi.SecretNameSSHPrimary, err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check access to the state store (S3/GCS bucket permissions, network reachability)
2. Verify KOPS_STATE_STORE is set correctly and the bucket exists
3. Retry after resolving the state-store access issue

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/apply_cluster.go:391 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/796733522e6ab41b. Report an issue: GitHub.