{"record":{"id":"147d4d96f4f1b9de","repo":"kubernetes/kops","slug":"secret-not-found-q","errorCode":null,"errorMessage":"Secret not found: %q","messagePattern":"Secret not found: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/secrets/clientset_secretstore.go","lineNumber":142,"sourceCode":"\t\tkeyset := &list.Items[i]\n\n\t\tif keyset.Spec.Type == kops.SecretTypeSecret {\n\t\t\tname := strings.TrimPrefix(keyset.Name, NamePrefix)\n\t\t\tnames = append(names, name)\n\t\t}\n\t}\n\n\treturn names, nil\n}\n\n// Secret implements fi.SecretStore::Secret\nfunc (c *ClientsetSecretStore) Secret(name string) (*fi.Secret, error) {\n\ts, err := c.FindSecret(name)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif s == nil {\n\t\treturn nil, fmt.Errorf(\"Secret not found: %q\", name)\n\t}\n\treturn s, nil\n}\n\n// DeleteSecret implements fi.SecretStore::DeleteSecret\nfunc (c *ClientsetSecretStore) DeleteSecret(name string) error {\n\tctx := context.TODO()\n\n\tclient := c.clientset.Keysets(c.namespace)\n\n\tkeyset, err := client.Get(ctx, name, metav1.GetOptions{})\n\tif err != nil {\n\t\tif errors.IsNotFound(err) {\n\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"error reading Keyset %q: %v\", name, err)\n\t}\n","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/secrets/clientset_secretstore.go#L124-L160","documentation":"This error is returned by ClientsetSecretStore.Secret when FindSecret (backed by loadSecret) returns nil, meaning no Keyset named token-<name> of type SecretTypeSecret with primary key material exists in the namespace. Unlike FindSecret, which returns (nil, nil) for missing secrets, Secret treats absence as a hard error. It indicates the requested secret name does not exist in the cluster's keyset store.","triggerScenarios":"Calling Secret(name) where the Keyset 'token-<name>' was never created, was already deleted via DeleteSecret, the name is misspelled, or the keyset exists but has no primary key entry (FindPrimary returns nil).","commonSituations":"Typo in the secret name passed to `kops get secret <name>`; secret deleted by rotation/cleanup tooling; querying the wrong namespace or wrong cluster's API server; a partially created keyset with no primary material.","solutions":["Run `kops get secrets` (ListSecrets) to see available secret names and confirm exact spelling","Check you are targeting the right cluster and namespace (correct kubeconfig/--name/--namespace)","If the secret was deleted unintentionally, recreate it (kops create secret / GetOrCreateSecret)","If the keyset exists but has no primary key, delete and recreate the keyset object"],"exampleFix":"// before: hard error on lookup\ns, err := store.Secret(\"admin\")\n// after: use FindSecret when absence is acceptable\ns, err := store.FindSecret(\"admin\")\nif err != nil { return err }\nif s == nil {\n    klog.Infof(\"secret %q not found; creating\", \"admin\")\n    s, _, err = store.GetOrCreateSecret(ctx, \"admin\", fi.NewSecret())\n    if err != nil { return err }\n}","handlingStrategy":"validation","validationCode":"// check existence first via FindSecret/listing before requiring the secret\nnames, err := store.ListSecrets()\nif err != nil { return err }\nfound := false\nfor _, n := range names {\n    if n == wantName { found = true; break }\n}\nif !found { return fmt.Errorf(\"secret %q does not exist; available: %v\", wantName, names) }","typeGuard":"func secretExists(store fi.SecretStore, name string) bool {\n    s, err := store.FindSecret(name)\n    return err == nil && s != nil\n}","tryCatchPattern":"s, err := store.Secret(name)\nif err != nil && strings.Contains(err.Error(), \"Secret not found\") {\n    s, _, err = store.GetOrCreateSecret(ctx, name, fi.NewSecret())\n}\nif err != nil { return err }","preventionTips":["List secrets (kops get secrets) before referencing a secret by name","Use FindSecret/GetOrCreateSecret when absence is an expected state","Double-check secret names for typos; names are prefixed internally with 'token-'","Verify you target the right cluster and namespace — secrets are per-cluster"],"tags":["kops","secrets","not-found"],"backgroundTag":"secret-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}