kubernetes/kops · error

error adding Cilium IPSec secret: %v

Error message

error adding Cilium IPSec secret: %v

What it means

RunCreateSecretCiliumEncryptionConfig calls GetOrCreateSecret to store the parsed Cilium IPSec config as the 'ciliumpassword' secret; this wraps that store call failing - state store write error, permissions, or connectivity. The config file itself was already read and parsed.

Source

Thrown at cmd/kops/create_secret_ciliumpassword.go:130

		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config %v: %v", options.CiliumPasswordFilePath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.CiliumPasswordFilePath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("error adding Cilium IPSec secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the Cilium IPSec secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("updating Cilium IPSec secret: %v", err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error for the state store failure reason
2. Verify write access to the cluster secret store
3. Retry after fixing state store connectivity

When it happens

Trigger: Thrown at cmd/kops/create_secret_ciliumpassword.go:130 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/58da1d2c70475edd. Report an issue: GitHub.