[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2024-11-21。"],[],[],null,["# Troubleshoot application-layer secrets encryption\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page shows you how to resolve issues related to\n[application-layer secrets encryption](/kubernetes-engine/docs/how-to/encrypting-secrets)\nin Google Kubernetes Engine (GKE).\n\nFailed update\n-------------\n\nWhen you update the encryption configuration of application-layer secrets encryption,\nGKE must rewrite all\n[Secret](https://kubernetes.io/docs/concepts/configuration/secret/) objects in\nthe Kubernetes cluster. GKE does this to ensure that all Secrets\nare encrypted by the new Cloud KMS Key, or are written un-encrypted if\nthat is what you configure.\n\nThis update operation can fail due to any of the following conditions:\n\n- The Kubernetes control plane is temporarily unavailable while the update is in progress.\n- A user-defined `AdmissionWebhook` prevents GKE from being able to update Secret objects.\n- The updated or previous Cloud KMS key is disabled before the update operation completes.\n\nUntil the update operation is successful, don't interact with either the\nupdated or previous Cloud KMS keys.\n\nDebugging fields\n----------------\n\n**New** GKE clusters running version 1.29 and later contain\nadditional fields that help you track updates to `Cluster.DatabaseEncryption`\nand help you recover from failures.\n\nThe following steps only apply to clusters where the\n`DatabaseEncryption.CurrentState` field is not empty. If the `CurrentState`\nfield is empty, the feature is not enabled on this cluster version yet.\n\nThe following limits apply to these fields:\n\n- Are **output only**, which means that you can't set them during cluster create or update requests.\n\n### `CurrentState` field\n\nYou can inspect the current status of a `DatabaseEncryption` update operation\nby examining the `CurrentState` field in `Cluster.DatabaseEncryption`.\n\n### `LastOperationErrors` field\n\nWhen an update operation fails, the underlying error from the GKE\ncontrol plane is displayed in the output of `gcloud container clusters update`.\n\nThe error messages from the two most recent failed update operations are also\navailable in `Cluster.DatabaseEncryption.LastOperationErrors`.\n\n### `DecryptionKeys` field\n\nThe Cloud KMS key used for new encryption operations is shown in\n`DatabaseEncryption.KeyName`. Usually this is the only key used by the cluster.\n\nHowever, `DatabaseEncryption.DecryptionKeys` contains additional keys that are\nalso used by the cluster if an update is in progress or after a failure.\n\nRecover from a failed update\n----------------------------\n\nTo recover from a failed update, do the following:\n\n1. Examine the error message and address any issues indicated.\n2. Retry the update request by running the failed command, such as `gcloud container clusters update ... --database-encryption-key`. We recommend that you retry with the same update request that you originally issued, or update the cluster back to the previous state. GKE might not be able to transition to a different key or encryption state if it can't read one or more Secrets.\n\nThe following sections list common reasons for errors.\n\n### Cloud KMS key error\n\nIf the error message contains a reference to one or more Cloud KMS\nkeys, examine your Cloud KMS key configuration to make sure the\nrelevant key versions are usable.\n\nIf the error indicates that a Cloud KMS key has been\ndisabled or destroyed, re-enable the key or key version.\n\n#### Error: Unable to use CloudKMS key configured for Application Level encryption\n\nThe following error message occurs if GKE's default service\naccount can't access the Cloud KMS key: \n\n Cluster problem detected (Kubernetes Engine Service Agent account unable to use CloudKMS key configured for Application Level encryption).\n\nTo resolve this issue,\n[re-enable the disabled key](/kms/docs/enable-disable#enable).\n\n### Unable to update Secret\n\nThe following error might occur if the Kubernetes API rejected the update\nrequest due to an admission webhook: \n\n error admission webhook WEBHOOK_NAME denied the request\n\nTo resolve this error, remove the webhook or modify it so that\nGKE can update Secrets in all namespaces during key updates.\n\n### Error: the namespace is managed\n\nThe following error occurs when you try to re-encrypt Secrets that are in a\nGKE-managed namespace, such as `kube-system`, in an\nAutopilot cluster. The error message is similar to the following: \n\n Error from server (Forbidden): secrets \"alertmanager\" is\n forbidden: User cannot patch resource \"secrets\" in API group \"\" in the namespace \"gke-gmp-system\":\n GKE Warden authz [denied by managed-namespaces-limitation]: the namespace \"gke-gmp-system\"\n is managed and the request's verb \"patch\" is denied'\n\nGKE Autopilot clusters don't allow you to modify\nKubernetes resources, including Secrets, in managed namespaces.\n\nTo resolve this error, do the following:\n\n- If you use `kubectl` commands to re-encrypt Secrets, use the `--namespace` flag to scope the command to namespaces that you manage.\n- If you use a CronJob to re-encrypt Secrets, deploy it in only the namespaces that you manage.\n\nWhat's next\n-----------\n\n- If you can't find a solution to your problem in the documentation, see\n [Get support](/kubernetes-engine/docs/getting-support) for further help,\n including advice on the following topics:\n\n - Opening a support case by contacting [Cloud Customer Care](/support-hub).\n - Getting support from the community by [asking questions on StackOverflow](http://stackoverflow.com/questions/tagged/google-kubernetes-engine) and using the `google-kubernetes-engine` tag to search for similar issues. You can also join the [`#kubernetes-engine` Slack channel](https://googlecloud-community.slack.com/messages/C0B9GKTKJ/) for more community support.\n - Opening bugs or feature requests by using the [public issue tracker](/support/docs/issue-trackers)."]]
