{"record":{"id":"5dbd99b71d43751a","repo":"kubernetes/kops","slug":"unhandled-secret-type-q-v","errorCode":null,"errorMessage":"unhandled secret type %q: %v","messagePattern":"unhandled secret type %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/clientset_castore.go","lineNumber":207,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing Keysets: %v\", err)\n\t\t}\n\n\t\tfor i := range list.Items {\n\t\t\tkeyset := &list.Items[i]\n\t\t\tswitch keyset.Spec.Type {\n\t\t\tcase kops.SecretTypeKeypair:\n\t\t\t\titem, err := parseKeyset(keyset)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"parsing keyset %q: %w\", keyset.Name, err)\n\t\t\t\t}\n\n\t\t\t\titems[keyset.Name] = item\n\n\t\t\tcase kops.SecretTypeSecret:\n\t\t\t\tcontinue // Ignore - this is handled by ClientsetSecretStore\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"unhandled secret type %q: %v\", keyset.Spec.Type, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn items, nil\n}\n\n// StoreKeyset implements CAStore::StoreKeyset\nfunc (c *ClientsetCAStore) StoreKeyset(ctx context.Context, name string, keyset *Keyset) error {\n\treturn c.storeKeyset(ctx, name, keyset)\n}\n\n// storeKeyset saves the specified keyset to the registry.\nfunc (c *ClientsetCAStore) storeKeyset(ctx context.Context, name string, keyset *Keyset) error {\n\tcreate := false\n\tclient := c.clientset.Keysets(c.namespace)\n\n\tkopsKeyset, err := keyset.ToAPIObject(name)","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/clientset_castore.go#L189-L225","documentation":"ListKeysets switches on keyset.Spec.Type; only SecretTypeKeypair is handled and SecretTypeSecret is skipped. Any other Spec.Type hits the default branch and returns 'unhandled secret type \"<type>\": <underlying>'. Notably the format verb references err (often nil), so the message may show '<nil>'. From upup/pkg/fi/clientset_castore.go:207.","triggerScenarios":"A Keyset object exists in the namespace whose Spec.Type is neither 'keypair' nor 'secret' — e.g. a type introduced by a newer kOps version, or a hand-created object with a wrong/empty type.","commonSituations":"Rolling back kOps after an upgrade introduced new keyset types; operators copying Keyset YAML by hand with a modified type field; CRD objects from other tooling sharing the namespace.","solutions":["Inspect kubectl get keysets -n <namespace> -o jsonpath='{.items[*].spec.type}' to find the offending object","Delete or correct the object with the unrecognized spec.type (or move it out of the kops namespace)","Upgrade kOps to a version that knows the new keyset type instead of downgrading","Patch ListKeysets to ignore unknown types (continue) rather than erroring if upstream allows"],"exampleFix":"// before\ndefault:\n\treturn nil, fmt.Errorf(\"unhandled secret type %q: %v\", keyset.Spec.Type, err)\n// after\ndefault:\n\tklog.Warningf(\"skipping keyset %q with unhandled type %q\", keyset.Name, keyset.Spec.Type)\n\tcontinue","handlingStrategy":"type-guard","validationCode":"types := map[string]bool{\"keypair\": true, \"secret\": true}\nfor _, ks := range allKeysets {\n\tif !types[string(ks.Spec.Type)] {\n\t\treturn fmt.Errorf(\"keyset %s has unsupported type %q\", ks.Name, ks.Spec.Type)\n\t}\n}","typeGuard":"func isKnownKeysetType(t kops.SecretType) bool {\n\treturn t == kops.SecretTypeKeypair || t == kops.SecretTypeSecret\n}","tryCatchPattern":"items, err := store.ListKeysets()\nif err != nil {\n\tif strings.Contains(err.Error(), \"unhandled secret type\") {\n\t\t// version mismatch: upgrade kOps or clean stray keysets\n\t}\n\treturn err\n}","preventionTips":["Avoid downgrade across kOps versions that add new keyset types","Never hand-craft Keyset objects with custom spec.type values","Keep other tooling out of the kops system namespace"],"tags":["go","keyset","versioning","validation"],"backgroundTag":"unhandled-secret-type","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}