kubernetes/kops · error

reading encryption config %v: %v

Error message

reading encryption config %v: %v

What it means

This error is returned by `kops create secret encryptionconfig` when `os.ReadFile` fails to read the encryption config file at `options.EncryptionConfigPath`. It wraps the underlying OS error (e.g. file-not-found, permission denied) so the user knows which path could not be read. The command needs the file's raw bytes to store as a Kubernetes encryptionconfig secret in the cluster state store.

Source

Thrown at cmd/kops/create_secret_encryptionconfig.go:111

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}
	var data []byte
	if options.EncryptionConfigPath == "-" {
		data, err = ConsumeStdin()
		if err != nil {
			return fmt.Errorf("reading encryption config from stdin: %v", err)
		}
	} else {
		data, err = os.ReadFile(options.EncryptionConfigPath)
		if err != nil {
			return fmt.Errorf("reading encryption config %v: %v", options.EncryptionConfigPath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.EncryptionConfigPath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("adding encryptionconfig secret: %v", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the file exists at the given path (`ls -l <path>`) and fix any typo or use an absolute path.
2. Check file permissions and ensure the user running kOps can read the file.
3. If passing a directory by mistake, point to the actual encryptionconfig YAML file.

Example fix

// before
kops create secret encryptionconfig --name cluster.example.com confgs/encryptionconfig.yaml
// after
kops create secret encryptionconfig --name cluster.example.com configs/encryptionconfig.yaml

const fs = require('fs');
if (!fs.existsSync(p) || !fs.statSync(p).isFile()) {
  throw new Error(`encryption config file not found: ${p}`);
}
fs.accessSync(p, fs.constants.R_OK);

function isReadableFile(p) {
  try { return require('fs').statSync(p).isFile(); } catch { return false; }
}

try {
  runKops(['create','secret','encryptionconfig', cluster, path]);
} catch (e) {
  if (/reading encryption config/.test(e.message)) {
    console.error(`Cannot read ${path}; check path and permissions.`);
  }
  throw e;
}

When it happens

Trigger: Running `kops create secret encryptionconfig --name <cluster> <path>` where the path passed as the positional argument does not exist, is a directory, or the process lacks read permission on it.

Common situations: Typos in the file path; running kOps from a different working directory with a relative path; the encryptionconfig file was deleted or renamed after generating it; SELinux/filesystem permissions blocking the read.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• error reading user provided private key %q: %v
• adding encryptionconfig secret: %v
• failed to create the encryptionconfig secret as it already e
• updating encryptionconfig secret: %v
• error reading SSH public key %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/774b662f10284ea4. Report an issue: GitHub.