kubernetes/kops · error

reading Cilium IPSec config %v: %v

Error message

reading Cilium IPSec config %v: %v

What it means

This error wraps an os.ReadFile failure for the Cilium IPsec configuration file passed with -f to `kops create secret ciliumpassword`. The file could not be opened or read, so the secret cannot be built. The '-' filename value routes to stdin instead, so this only fires for real paths.

Source

Thrown at cmd/kops/create_secret_ciliumpassword.go:113

	if err != nil {
		return err
	}

	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}

	var data []byte
	if options.CiliumPasswordFilePath == "-" {
		data, err = ConsumeStdin()
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config from stdin: %v", err)
		}
	} else {
		data, err = os.ReadFile(options.CiliumPasswordFilePath)
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config %v: %v", options.CiliumPasswordFilePath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.CiliumPasswordFilePath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("error adding Cilium IPSec secret: %v", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the path exists: ls -l <path>.
2. Use an absolute path to avoid CWD ambiguity.
3. Check read permissions for the invoking user.
4. Copy/export the config to an accessible location, then re-run.

Example fix

// before
kops create secret ciliumpassword cluster.example.com -f ./cilium.yaml
// error: open ./cilium.yaml: no such file or directory
// after
kops create secret ciliumpassword cluster.example.com -f /etc/cilium/config.yaml

if path != "-" {
    fi, err := os.Stat(path)
    if err != nil {
        return fmt.Errorf("cilium config not accessible: %w", err)
    }
    if fi.IsDir() {
        return errors.New("path is a directory")
    }
    if fi.Size() == 0 {
        return errors.New("cilium config is empty")
    }
}

if err != nil && strings.Contains(err.Error(), "reading Cilium IPSec config") {
    // surface the wrapped os error and the expanded path
}

When it happens

Trigger: Running `kops create secret ciliumpassword <cluster> -f <path>` where <path> does not exist, is misspelled, is a directory, or is not readable by the current user.

Common situations: Wrong working directory with a relative path; file deleted before the run; permissions blocked by secret-management tooling; shell expansion producing an unexpected path.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• error reading file %q: %v
• error reading SSH key file %q: %v
• error reading SSH public key files %q: %v
• error reading user provided cert %q: %v
• unable to open file: %s, error: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a47a9880634aafe3. Report an issue: GitHub.