kubernetes/kops · error

failed to create the dockerconfig secret as it already exist

Error message

failed to create the dockerconfig secret as it already exists. Pass the `--force` flag to replace an existing secret

What it means

GetOrCreateSecret found the 'dockerconfig' secret already exists, so nothing was created. Without --force, kops refuses to overwrite an existing registry credential secret to avoid breaking image pulls on running nodes.

Source

Thrown at cmd/kops/create_secret_dockerconfig.go:138

	}

	var parsedData map[string]interface{}
	err = json.Unmarshal(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse JSON %v: %v", options.DockerConfigPath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "dockerconfig", secret)
		if err != nil {
			return fmt.Errorf("adding dockerconfig secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the dockerconfig secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("dockerconfig", secret)
		if err != nil {
			return fmt.Errorf("updating dockerconfig secret: %v", err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run with --force to intentionally replace the existing secret
2. Keep the existing secret if replacement was not intended

When it happens

Trigger: Thrown at cmd/kops/create_secret_dockerconfig.go:138 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c93a1db162360764. Report an issue: GitHub.