{"record":{"id":"6db26c7406418120","repo":"kubernetes/kops","slug":"secret-q-not-found","errorCode":null,"errorMessage":"secret %q not found","messagePattern":"secret %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/configserver/secretstore.go","lineNumber":43,"sourceCode":"// configserverSecretStore is a SecretStore backed by the config server.\ntype configserverSecretStore struct {\n\tnodeSecrets map[string][]byte\n}\n\nfunc NewSecretStore(nodeSecrets map[string][]byte) fi.SecretStoreReader {\n\treturn &configserverSecretStore{\n\t\tnodeSecrets: nodeSecrets,\n\t}\n}\n\n// Secret implements fi.SecretStoreReader\nfunc (s *configserverSecretStore) Secret(id string) (*fi.Secret, error) {\n\tsecret, err := s.FindSecret(id)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif secret == nil {\n\t\treturn nil, fmt.Errorf(\"secret %q not found\", id)\n\t}\n\treturn secret, nil\n}\n\n// FindSecret implements fi.SecretStoreReader\nfunc (s *configserverSecretStore) FindSecret(id string) (*fi.Secret, error) {\n\tsecretBytes, ok := s.nodeSecrets[id]\n\tif !ok {\n\t\treturn nil, nil\n\t}\n\tsecret := &fi.Secret{\n\t\tData: secretBytes,\n\t}\n\treturn secret, nil\n}\n","sourceCodeStart":25,"sourceCodeEnd":59,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/configserver/secretstore.go#L25-L59","documentation":"configserverSecretStore.Secret wraps FindSecret and converts a nil result into a hard error when the requested secret ID does not exist in the config-server secret store. Unlike the reader variant, Secret() is expected to always return a secret, so absence is treated as failure. This means the secret was never created in the config server or the ID is wrong.","triggerScenarios":"Calling fi.SecretStore.Secret(id) where FindSecret returns (nil, nil) — i.e. no secret with that ID is stored in the config-server backend.","commonSituations":"Fresh cluster before secrets are uploaded to the config server; typo in secret ID; secrets lost after config-server state reset; running commands that assume a secret exists (e.g. docker pull-through, admin password lookups) without creating it first.","solutions":["Create/upload the missing secret to the config server before use","Verify the exact secret ID spelling and the state store the code is pointed at","Re-run the appropriate 'kops create secret' command to populate the secret"],"exampleFix":"// before\nsecret, err := secretStore.Secret(\"dockerconfig\") // fails when absent\n// after\nsecret, err := secretStore.FindSecret(\"dockerconfig\")\nif err != nil { return err }\nif secret == nil { secret, err = createAndStoreSecret(\"dockerconfig\") }","handlingStrategy":"try-catch","validationCode":"secret, err := store.FindSecret(id)\nif err != nil { return err }\nif secret == nil {\n\treturn fmt.Errorf(\"secret %q missing; create it with 'kops create secret' first\", id)\n}","typeGuard":null,"tryCatchPattern":"secret, err := store.Secret(id)\nif err != nil && strings.Contains(err.Error(), \"not found\") {\n\t// create or upload the secret, then retry\n\treturn createSecret(id)\n}\nif err != nil { return err }","preventionTips":["Create required secrets (e.g. admin, dockerconfig) before operations that read them","Use FindSecret for optional lookups instead of Secret","Verify the state store/config-server you query is the one holding the secret"],"tags":["secrets","configserver","not-found"],"backgroundTag":"secret-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}