[Release-1.33] - Support enabling secrets encryption after a cluster has been created

[dereknola]

Backport fix for Support enabling secrets encryption after a cluster has been created

• Support enabling secrets encryption after a cluster has been created #7195

[aganesh-suse]

Validated on release-1.33 branch with PR number: 13405

Environment Details

Infrastructure

• Cloud
• Hosted

Node(s) CPU architecture, OS, and Version:

$ cat /etc/os-release
PRETTY_NAME="Ubuntu 24.04 LTS"

$ uname -m
x86_64

Cluster Configuration:

HA: 3 server(1 etcd, 2 cp)/ 1 agent

Config.yaml:

etcd server:

token: xxxx
cluster-init: true
write-kubeconfig-mode: "0644"
node-external-ip: 1.1.1.1
node-label:
- k3s-upgrade=server
debug: true
disable-apiserver: true
disable-controller-manager: true
disable-scheduler: true
node-taint:
- node-role.kubernetes.io/etcd:NoExecute

cp only server:

token: xxxx
server: https://1.1.1.1:6443
disable-etcd: true
node-taint:
- node-role.kubernetes.io/control-plane:NoSchedule
write-kubeconfig-mode: "0644"
node-external-ip: 2.2.2.2
node-label:
- k3s-upgrade=server
debug: true

Testing Steps

1. Copy config.yaml

$ sudo mkdir -p /etc/rancher/k3s && sudo cp config.yaml /etc/rancher/k3s

2. Install k3s

curl -sfL https://get.k3s.io | sudo INSTALL_K3S_PR="13405" GITHUB_PR_URL="https://github.com/k3s-io/k3s/pull/13405" GITHUB_TOKEN="xxxx" sh -s - server

3. Verify Cluster Status:

kubectl get nodes -o wide
kubectl get pods -A

4. Verification steps:
   Start k3s servers with no SE
   check k3s secrets-encrypt status on control plane node, should be disabled
   Run k3s secrets-encrypt enable on a single control plane server
   Restart k3s servers with --secrets-encryption or update the config.yaml with secrets-encryption: true and restart k3s servers - etcd first, then control plane nodes.
   check k3s secrets-encrypt status (on control plane server), still disabled, but with the stage: start
   Run k3s secrets-encrypt rotate-keys on a single control plane server
   Restart all k3s servers
   check k3s secrets-encrypt status (on control plane server), should be enabled with aescbc

Validation Results:

• k3s version used for validation:

$ k3s -v
k3s version v1.33.7+k3s-e84e8088 (e84e8088)
go version go1.24.11

On control plane node:

$ sudo k3s secrets-encrypt status 
Encryption Status: Disabled, no configuration file found

On control plane node:

$ sudo k3s secrets-encrypt enable
secrets-encryption enabled

On all k3s server nodes:

$ sudo sed -i -re '/^token:/a\secrets-encryption: true' /etc/rancher/k3s/config.yaml 
$ sudo systemctl restart k3s 

On control plane node:

$ sudo k3s secrets-encrypt status 
Encryption Status: Disabled
Current Rotation Stage: start
Server Encryption Hashes: All hashes match

On control plane node:

$ sudo k3s secrets-encrypt rotate-keys 
keys rotated, reencryption finished

On control plane node:

$ sudo k3s secrets-encrypt status 
Encryption Status: Enabled
Current Rotation Stage: reencrypt_finished
Server Encryption Hashes: All hashes match

Active  Key Type  Name
------  --------  ----
 *      AES-CBC   aescbckey-2026-01-08T00:01:21Z