kubernetes/kops · error

reading Cilium IPSec config from stdin: %v

Error message

reading Cilium IPSec config from stdin: %v

What it means

This error wraps a failure from ConsumeStdin() when `kops create secret ciliumpassword -f -` reads the Cilium IPsec configuration from standard input. The stdin stream could not be read to completion, so the secret is not created.

Source

Thrown at cmd/kops/create_secret_ciliumpassword.go:108

	if err != nil {
		return err
	}

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}

	var data []byte
	if options.CiliumPasswordFilePath == "-" {
		data, err = ConsumeStdin()
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config from stdin: %v", err)
		}
	} else {
		data, err = os.ReadFile(options.CiliumPasswordFilePath)
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config %v: %v", options.CiliumPasswordFilePath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.CiliumPasswordFilePath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure a producer is actually piping data: `cat config.yaml | kops create secret ciliumpassword ... -f -`.
2. Check the upstream command's exit status — its failure is the wrapped cause.
3. Use a real file instead: `kops create secret ciliumpassword <cluster> -f cilium-config.yaml`.
4. In CI, provide stdin or switch to the file-based invocation.

Example fix

// before (no stdin attached, fails in CI)
kops create secret ciliumpassword cluster.example.com -f -
// after
kops create secret ciliumpassword cluster.example.com -f cilium-ipsec.yaml

err := run("kops", "create", "secret", "ciliumpassword", cluster, "-f", "-")
if err != nil && strings.Contains(err.Error(), "reading Cilium IPSec config from stdin") {
    // fall back to file-based invocation
    return run("kops", "create", "secret", "ciliumpassword", cluster, "-f", configFile)
}

When it happens

Trigger: Running `kops create secret ciliumpassword <cluster> -f -` and ConsumeStdin fails — stdin is closed, the pipe producer errored mid-stream, or the read was interrupted.

Common situations: Piping from a command that failed partway (`cmd | kops create secret ... -f -`); running non-interactively with no stdin attached; Ctrl-C during entry; CI jobs without stdin.

Related errors

• error writing to output: %v
• reading from stdin: %v
• error writing to output: %v
• error writing to output: %v
• writing output: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/96aefb83d422ffcd. Report an issue: GitHub.