kubernetes/kops · error

unable to parse YAML %v: %v

Error message

unable to parse YAML %v: %v

What it means

Returned when `kops.ParseRawYaml` fails to unmarshal the encryption config file contents into a `map[string]interface{}`. kOps parses the YAML purely to validate that the file is well-formed YAML before storing its raw bytes as the encryptionconfig secret. A YAML syntax error (bad indentation, tabs, malformed keys) triggers this error.

Source

Thrown at cmd/kops/create_secret_encryptionconfig.go:118

		return err
	}
	var data []byte
	if options.EncryptionConfigPath == "-" {
		data, err = ConsumeStdin()
		if err != nil {
			return fmt.Errorf("reading encryption config from stdin: %v", err)
		}
	} else {
		data, err = os.ReadFile(options.EncryptionConfigPath)
		if err != nil {
			return fmt.Errorf("reading encryption config %v: %v", options.EncryptionConfigPath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.EncryptionConfigPath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("adding encryptionconfig secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the encryptionconfig secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("encryptionconfig", secret)
		if err != nil {
			return fmt.Errorf("updating encryptionconfig secret: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate the file with a YAML linter (`yamllint <path>` or `python -c 'import yaml,sys; yaml.safe_load(open(sys.argv[1]))' <path>`) and fix the reported syntax error.
2. Replace tabs with spaces and confirm consistent 2-space indentation.
3. Confirm the file is a Kubernetes EncryptionConfiguration YAML document, not another artifact.

Example fix

// before (tabs cause parse failure)
resources:
	- providers:
// after (spaces only)
resources:
  - providers:

const yaml = require('js-yaml');
try { yaml.load(fs.readFileSync(path, 'utf8')); }
catch (e) { throw new Error(`Invalid YAML in ${path}: ${e.message}`); }

function isValidYaml(text) {
  try { require('js-yaml').load(text); return true; } catch { return false; }
}

try {
  runKops(['create','secret','encryptionconfig', cluster, path]);
} catch (e) {
  if (/unable to parse YAML/.test(e.message)) {
    console.error('Fix YAML syntax in ' + path + ' (indentation, tabs, quotes).');
  }
  throw e;
}

When it happens

Trigger: Running `kops create secret encryptionconfig` with a file whose contents are not valid YAML — e.g. tabs for indentation, unbalanced quotes/brackets, or accidentally passing a binary or JSON-syntax-error file.

Common situations: Hand-edited EncryptionConfiguration manifests introducing indentation errors; passing a kube-apiserver binary secret instead of YAML; Windows line-ending or encoding issues; copy-pasting YAML from docs losing indentation.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• parsing file %q: %v
• spec.PublicKey is required
• adding keypair to %q is not supported
• error adding SSH public key: %v
• --name is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ba776d5d3d0743dd. Report an issue: GitHub.