{"record":{"id":"7159e15a5ee307ab","repo":"kubernetes/kops","slug":"failed-to-create-bootstrap-data-secret-for-kopscon","errorCode":null,"errorMessage":"failed to create bootstrap data secret for KopsConfig %s/%s: %w","messagePattern":"failed to create bootstrap data secret for KopsConfig (.+?)/(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/controllers/clusterapi/kopsconfig_controller.go","lineNumber":158,"sourceCode":"\t\tType: clusterv1.ClusterSecretType,\n\t}\n\n\tparentAPIVersion, parentKind := parent.GetObjectKind().GroupVersionKind().ToAPIVersionAndKind()\n\tsecret.OwnerReferences = []metav1.OwnerReference{\n\t\t{\n\t\t\tAPIVersion: parentAPIVersion,\n\t\t\tKind:       parentKind,\n\t\t\tName:       parent.GetName(),\n\t\t\tUID:        parent.GetUID(),\n\t\t\tController: pointer.Bool(true),\n\t\t},\n\t}\n\n\tvar existing corev1.Secret\n\tif err := r.client.Get(ctx, secretName, &existing); err != nil {\n\t\tif apierrors.IsNotFound(err) {\n\t\t\tif err := r.client.Create(ctx, secret); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create bootstrap data secret for KopsConfig %s/%s: %w\", parent.GetNamespace(), parent.GetName(), err)\n\t\t\t}\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"failed to get bootstrap data secret: %w\", err)\n\t\t}\n\t} else {\n\t\t// TODO: Verify that the existing secret \"matches\"\n\t\tklog.Warningf(\"TODO: verify that the existing secret matches our expected value\")\n\t}\n\n\tparent.Status.DataSecretName = pointer.String(secret.Name)\n\tparent.Status.Ready = true\n\t// conditions.MarkTrue(scope.Config, bootstrapv1.DataSecretAvailableCondition)\n\treturn nil\n}\n\nfunc (r *KopsConfigReconciler) buildBootstrapData(ctx context.Context, cluster *kopsapi.Cluster, kopsControlPlane *capikops.KopsControlPlane) ([]byte, error) {\n\twellKnownAddresses := model.WellKnownAddresses{}\n\tfor _, systemEndpoint := range kopsControlPlane.Status.SystemEndpoints {","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/controllers/clusterapi/kopsconfig_controller.go#L140-L176","documentation":"storeBootstrapData creates a Secret (same name/namespace as the KopsConfig) holding the nodeup bootstrap script, after confirming no such secret exists. This error wraps a failure of the Secret Create call — RBAC denial, quota/limits, validation, or the secret appearing concurrently (AlreadyExists races through a NotFound Get).","triggerScenarios":"r.client.Create fails because the controller ServiceAccount lacks create permission on secrets; the namespace has a resource quota or Secret count limit; a concurrent reconcile created the secret between the Get (NotFound) and Create (AlreadyExists); the API server rejects the object (too large, invalid ownerRef).","commonSituations":"Fresh installs with incomplete RBAC; rapid re-reconciles racing to create the same secret; namespaces enforcing quotas on secret count or size; very large bootstrap scripts hitting etcd object limits.","solutions":["Grant RBAC create on secrets to the controller ServiceAccount","Handle AlreadyExists gracefully: treat a concurrent create as success and proceed to set the status","Check namespace ResourceQuotas and LimitRanges for secret count/size constraints","Inspect the wrapped error to distinguish Forbidden vs AlreadyExists vs validation","Retry the reconcile — the next pass will find the existing secret via the Get"],"exampleFix":"// before\nif err := r.client.Create(ctx, secret); err != nil {\n    return fmt.Errorf(\"failed to create bootstrap data secret for KopsConfig %s/%s: %w\", parent.GetNamespace(), parent.GetName(), err)\n}\n// after: tolerate the create/get race\nif err := r.client.Create(ctx, secret); err != nil {\n    if !apierrors.IsAlreadyExists(err) {\n        return fmt.Errorf(\"failed to create bootstrap data secret for KopsConfig %s/%s: %w\", parent.GetNamespace(), parent.GetName(), err)\n    }\n}","handlingStrategy":"retry","validationCode":"kubectl auth can-i create secrets -n <namespace> --as=system:serviceaccount:<ns>:<sa>\nkubectl get resourcequota -n <namespace>","typeGuard":null,"tryCatchPattern":"if err := r.client.Create(ctx, secret); err != nil {\n    if apierrors.IsAlreadyExists(err) {\n        return nil // concurrent reconcile won the race; proceed to status update\n    }\n    return fmt.Errorf(\"failed to create bootstrap data secret for KopsConfig %s/%s: %w\", parent.GetNamespace(), parent.GetName(), err)\n}","preventionTips":["Grant create/update on secrets in the controller RBAC before install","Handle AlreadyExists as success to survive reconcile races","Monitor namespace resource quotas limiting secret count/size","Requeue on transient API-server errors; the Get path will find the secret next pass"],"tags":["kubernetes","secret","rbac","bootstrap"],"backgroundTag":"secret-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}