kubernetes/kops · error

unable to parse YAML %v: %v

Error message

unable to parse YAML %v: %v

What it means

This error occurs when the Cilium IPsec config data read from the file or stdin is not valid YAML. kops.ParseRawYaml fails to decode the bytes into a map[string]interface{}, so the config cannot be validated and stored as the ciliumpassword secret.

Source

Thrown at cmd/kops/create_secret_ciliumpassword.go:120

	}

	var data []byte
	if options.CiliumPasswordFilePath == "-" {
		data, err = ConsumeStdin()
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config from stdin: %v", err)
		}
	} else {
		data, err = os.ReadFile(options.CiliumPasswordFilePath)
		if err != nil {
			return fmt.Errorf("reading Cilium IPSec config %v: %v", options.CiliumPasswordFilePath, err)
		}
	}

	var parsedData map[string]interface{}
	err = kops.ParseRawYaml(data, &parsedData)
	if err != nil {
		return fmt.Errorf("unable to parse YAML %v: %v", options.CiliumPasswordFilePath, err)
	}

	secret := &fi.Secret{
		Data: data,
	}

	if !options.Force {
		_, created, err := secretStore.GetOrCreateSecret(ctx, "ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("error adding Cilium IPSec secret: %v", err)
		}
		if !created {
			return fmt.Errorf("failed to create the Cilium IPSec secret as it already exists. Pass the `--force` flag to replace an existing secret")
		}
	} else {
		_, err := secretStore.ReplaceSecret("ciliumpassword", secret)
		if err != nil {
			return fmt.Errorf("updating Cilium IPSec secret: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate the file: `yamllint <path>` or load it in a YAML parser to find the error line.
2. Replace tabs with spaces and fix indentation/quotes at the reported line.
3. Ensure you pass the Cilium YAML config (keys/values map), not a raw binary key.
4. Re-download or regenerate the config if corrupted.

Example fix

# before (tabs cause parse failure)
keys:
	key: abc
# after
keys:
  key: abc

data, _ := os.ReadFile(path)
var probe map[string]interface{}
if err := yaml.Unmarshal(data, &probe); err != nil {
    return fmt.Errorf("invalid YAML at %s: %w", path, err)
}
if !utf8.Valid(data) {
    return errors.New("config is not valid UTF-8 text")
}

if err != nil && strings.Contains(err.Error(), "unable to parse YAML") {
    // run yamllint on the file to locate the offending line
}

When it happens

Trigger: Running `kops create secret ciliumpassword -f <path>` (or via stdin) where the content has YAML syntax errors: bad indentation, tabs, unclosed quotes, or binary/non-UTF8 garbage.

Common situations: Hand-edited config with tab characters; copied YAML losing indentation; passing a binary IPsec key file instead of the YAML config; editor adding non-UTF8 characters.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• error parsing addons or manifest: %v
• error parsing addons: %v
• failed to parse objects: %w
• failed to parse objects: %w
• error parsing file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/188a57dbbd170d78. Report an issue: GitHub.