{"record":{"id":"84b11f7a1f0fbec1","repo":"kubernetes/kops","slug":"error-reading-secret-q-for-mirror-v","errorCode":null,"errorMessage":"error reading secret %q for mirror: %v","messagePattern":"error reading secret %q for mirror: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/secrets/vfs_secretstore.go","lineNumber":65,"sourceCode":"\treturn c\n}\n\nfunc (c *VFSSecretStore) MirrorTo(ctx context.Context, basedir vfs.Path) error {\n\tif basedir.Path() == c.basedir.Path() {\n\t\tklog.V(2).Infof(\"Skipping mirror of secret store from %q to %q (same path)\", c.basedir, basedir)\n\t\treturn nil\n\t}\n\tklog.V(2).Infof(\"Mirroring secret store from %q to %q\", c.basedir, basedir)\n\n\tsecrets, err := c.ListSecrets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error listing secrets for mirror: %v\", err)\n\t}\n\n\tfor _, name := range secrets {\n\t\tsecret, err := c.FindSecret(name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading secret %q for mirror: %v\", name, err)\n\t\t}\n\n\t\tif secret == nil {\n\t\t\treturn fmt.Errorf(\"unable to find secret %q for mirror\", name)\n\t\t}\n\n\t\tp := BuildVfsSecretPath(basedir, name)\n\n\t\tacl, err := acls.GetACL(ctx, p, c.cluster)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building acl for secret %q for mirror: %v\", name, err)\n\t\t}\n\n\t\tklog.Infof(\"mirroring secret %s -> %s\", name, p)\n\n\t\terr = createSecret(ctx, secret, p, acl, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error writing secret %q for mirror: %v\", name, err)","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/secrets/vfs_secretstore.go#L47-L83","documentation":"During MirrorTo, after listing secret names, each name is loaded with FindSecret(). If FindSecret returns a non-nil error (e.g. the file exists in the listing but its contents cannot be read, or the JSON is corrupt), the error is wrapped as 'error reading secret %q for mirror'. It indicates the store is inconsistent or unreadable mid-mirror.","triggerScenarios":"Listing returned a secret name but reading <basedir>/<name> fails: network/permission error on the object, or the object content is not valid JSON (loadSecret only swallows IsNotExist; corrupt files produce 'parsing secret from ...' which is wrapped here).","commonSituations":"Partially deleted or truncated secret files in the state store, concurrent modification during mirror (kops CLI run twice), corrupted uploads to the secrets prefix.","solutions":["Inspect the wrapped cause: if it's 'parsing secret', the file is corrupt — re-create the secret with `kops replace secret` or delete it","Check read permissions on the specific secret object in the state store","Re-run the mirror once network/concurrent-modification issues are resolved","Back up the secrets prefix before any manual repair"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate each listed secret parses before mirroring\nfor _, id := range mustList(store) {\n    if _, err := store.FindSecret(id); err != nil {\n        return fmt.Errorf(\"secret %s unreadable: %v\", id, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := store.MirrorTo(ctx, target); err != nil {\n    var name string\n    if _, scanErr := fmt.Sscanf(err.Error(), \"error reading secret %q for mirror\", &name); scanErr == nil {\n        return fmt.Errorf(\"repair or delete corrupt secret %q, then retry\", name)\n    }\n    return err\n}","preventionTips":["Avoid running multiple kops processes against one state store concurrently","Validate secret JSON after any manual edit of the state store","Back up the secrets prefix before pruning operations","Monitor state store integrity (e.g. s3 inventory checksums)"],"tags":["vfs","secrets","corruption","mirror"],"backgroundTag":"secret-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}