kubernetes/kops · error

failed to create the encryptionconfig secret as it already e

Error message

failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret

What it means

A deliberate, actionable error: `GetOrCreateSecret` returned successfully but reported the secret already existed, and `--force` was not passed. kOps refuses to silently overwrite an existing `encryptionconfig` secret, telling the user to pass `--force` to replace it.

Source

Thrown at cmd/kops/create_secret_encryptionconfig.go:131

	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.EncryptionConfigPath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("adding encryptionconfig secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("updating encryptionconfig secret: %v", err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run with `--force` if you intentionally want to replace the existing encryptionconfig secret.
2. If you didn't intend to replace it, inspect the existing secret first (`kops get secret encryptionconfig --name <cluster> -oplaintext`) and skip the command.
3. Make automation idempotent: only run the create when the secret is absent, or always pass --force deliberately.

Example fix

// before
kops create secret encryptionconfig --name c.example.com enc.yaml
// after
kops create secret encryptionconfig --name c.example.com enc.yaml --force

// check whether the secret exists before creating
const out = execSync(`kops get secret encryptionconfig --name ${cluster} -oplaintext || true`).toString();
const exists = out.trim().length > 0;
const args = ['create','secret','encryptionconfig', cluster, path];
if (exists) args.push('--force'); // deliberate replacement only

try {
  runKops(['create','secret','encryptionconfig', cluster, path]);
} catch (e) {
  if (/already exists/.test(e.message)) {
    console.error('Secret exists; rerun with --force to replace intentionally.');
  }
  throw e;
}

When it happens

Trigger: Running `kops create secret encryptionconfig` (without `--force`) for a cluster that already has an encryptionconfig secret in the state store; `created` is false because the secret was previously created.

Common situations: Re-running the create command after a first successful run (e.g. in automation/CI without idempotency handling); rotating the key but forgetting `--force`; a shared cluster where another operator already created the secret.

Related errors

• reading encryption config %v: %v
• adding encryptionconfig secret: %v
• updating encryptionconfig secret: %v
• error adding SSH public key: %v
• must specify %q label with cluster name to create instanceGr

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c566c3da53ac3782. Report an issue: GitHub.