kubernetes/kops · critical

SecretStore not set

Error message

SecretStore not set

What it means

nodeup requires a source for cluster secrets (TLS material, passwords). If no config-server NodeConfig is present, it looks for nodeupConfig.ConfigStore.Secrets; when ConfigStore is nil or Secrets is empty, the switch falls to default and Run returns this error. Without a SecretStore, nodeup cannot provision k8s secrets on the node.

Source

Thrown at upup/pkg/fi/nodeup/command.go:226

		NodeupConfig: &nodeupConfig,
	}

	var secretStore fi.SecretStoreReader
	var keyStore fi.KeystoreReader
	switch {
	case nodeConfig != nil:
		modelContext.SecretStore = configserver.NewSecretStore(nodeConfig.NodeSecrets)
	case nodeupConfig.ConfigStore != nil && nodeupConfig.ConfigStore.Secrets != "":
		klog.Infof("Building SecretStore at %q", nodeupConfig.ConfigStore.Secrets)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)
		if err != nil {
			return fmt.Errorf("error building secret store path: %v", err)
		}

		secretStore = secrets.NewVFSSecretStoreReader(p)
		modelContext.SecretStore = secretStore
	default:
		return fmt.Errorf("SecretStore not set")
	}

	if nodeConfig != nil {
		modelContext.KeyStore = configserver.NewKeyStore()
	} else if nodeupConfig.ConfigStore.Keypairs != "" {
		klog.Infof("Building KeyStore at %q", nodeupConfig.ConfigStore.Keypairs)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)
		if err != nil {
			return fmt.Errorf("error building key store path: %v", err)
		}

		modelContext.KeyStore = fi.NewVFSKeystoreReader(p)
		keyStore = modelContext.KeyStore
	} else {
		return fmt.Errorf("KeyStore not set")
	}

	if err := modelContext.Init(); err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run 'kops update cluster --yes' with the current kOps version so nodeupconfig.yaml includes the configStore.secrets path.
2. Add the secrets path to the cluster spec (configStore.secrets, e.g. s3://bucket/cluster/secrets) and re-apply.
3. Verify the node is configured for the right mode: if you intend config-server mode, set bootConfig.ConfigServer.Servers; otherwise ensure VFS ConfigStore is populated.
4. Compare nodeupconfig.yaml in the state store against a fresh cluster's file to spot missing fields from schema drift after a kOps upgrade.

Example fix

// before (nodeupconfig.yaml)
configStore: {}
// after
configStore:
  secrets: s3://bucket/cluster.k8s.local/secrets
  keypairs: s3://bucket/cluster.k8s.local/pki

// Require a secret store source before invoking nodeup
if nodeConfig == nil && (cfg.ConfigStore == nil || cfg.ConfigStore.Secrets == "") {
    return fmt.Errorf("configStore.secrets must be set (or use ConfigServer mode)")
}

err := cmd.Run(out)
if err != nil && strings.Contains(err.Error(), "SecretStore not set") {
    // regenerate nodeupconfig.yaml via kops update cluster
}

When it happens

Trigger: Running NodeUpCommand.Run() in VFS mode where nodeupConfig.ConfigStore is nil or ConfigStore.Secrets == "" and nodeConfig == nil — i.e. the parsed nodeupconfig.yaml lacks the configStore.secrets field entirely.

Common situations: Older kOps state stores whose nodeupconfig.yaml predates the ConfigStore field; hand-trimmed or corrupted nodeupconfig.yaml; configs generated for config-server mode but booted via VFS (or vice versa), leaving the field empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• no instance group defined in nodeup config
• building nodeConfig for instanceGroup: %w
• unsupported cloud provider for authenticator %q
• no keypairID for %q
• KubeProxy not configured

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/78dcf10e975353ed. Report an issue: GitHub.