kubernetes/kops · error

failed to create the Cilium IPSec secret as it already exist

Error message

failed to create the Cilium IPSec secret as it already exists. Pass the `--force` flag to replace an existing secret

What it means

GetOrCreateSecret found that the 'ciliumpassword' secret already exists, so it did not create a new one; without --force, overwriting an existing Cilium IPSec secret is refused to avoid invalidating keys in use by a running cluster.

Source

Thrown at cmd/kops/create_secret_ciliumpassword.go:133

	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.CiliumPasswordFilePath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("error adding Cilium IPSec secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the Cilium IPSec secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("updating Cilium IPSec secret: %v", err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run with --force to intentionally replace the existing secret
2. Keep the existing secret if rotation was not intended
3. Understand that replacing the key disrupts existing IPSec sessions until nodes reload it

When it happens

Trigger: Thrown at cmd/kops/create_secret_ciliumpassword.go:133 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/96b75506ff2656e3. Report an issue: GitHub.