kubernetes/kops · error

encryptionConfig enabled, but could not load encryptionconfi

Error message

encryptionConfig enabled, but could not load encryptionconfig secret: %v

What it means

Guard in the kube-apiserver builder: encryption at rest is enabled (EncryptionConfigSecretHash is set) but the 'encryptionconfig' secret could not be loaded from the secret store, so the EncryptionProviderConfig file cannot be written.

Source

Thrown at nodeup/pkg/model/kube_apiserver.go:153

	if b.NodeupConfig.APIServerConfig.EncryptionConfigSecretHash != "" {
		encryptionConfigPath := new(filepath.Join(pathSrvKAPI, "encryptionconfig.yaml"))

		kubeAPIServer.EncryptionProviderConfig = encryptionConfigPath

		key := "encryptionconfig"
		encryptioncfg, err := b.SecretStore.Secret(key)
		if err == nil {
			contents := string(encryptioncfg.Data)
			t := &nodetasks.File{
				Path:     *encryptionConfigPath,
				Contents: fi.NewStringResource(contents),
				Mode:     new("600"),
				Type:     nodetasks.FileType_File,
			}
			c.AddTask(t)
		} else {
			return fmt.Errorf("encryptionConfig enabled, but could not load encryptionconfig secret: %v", err)
		}
	}

	kubeAPIServer.ServiceAccountKeyFile = append(kubeAPIServer.ServiceAccountKeyFile, filepath.Join(pathSrvKAPI, "service-account.pub"))
	c.AddTask(&nodetasks.File{
		Path:     filepath.Join(pathSrvKAPI, "service-account.pub"),
		Contents: fi.NewStringResource(b.NodeupConfig.APIServerConfig.ServiceAccountPublicKeys),
		Type:     nodetasks.FileType_File,
		Mode:     s("0600"),
	})

	// Set the signing key if we're using Service Account Token VolumeProjection
	if kubeAPIServer.ServiceAccountSigningKeyFile == nil {
		s := filepath.Join(pathSrvKAPI, "service-account.key")
		kubeAPIServer.ServiceAccountSigningKeyFile = &s
		if err := b.BuildPrivateKeyTask(c, "service-account", pathSrvKAPI, "service-account", nil, nil); err != nil {
			return err
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-create the encryption config secret (kops create secret encryptionconfig)
2. Check state store access from the node
3. Verify the secret hash matches the cluster spec

When it happens

Trigger: Thrown at nodeup/pkg/model/kube_apiserver.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0ae7628d38d66d6a. Report an issue: GitHub.