{"record":{"id":"9f2749cbeb1cdc42","repo":"kubernetes/kops","slug":"unknown-secret-type-q","errorCode":null,"errorMessage":"unknown secret type %q","messagePattern":"unknown secret type %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_secrets.go","lineNumber":110,"sourceCode":"\t\t\t\tmatches = append(matches, item)\n\t\t\t}\n\t\t}\n\t\titems = matches\n\t}\n\n\treturn items, nil\n}\n\nfunc RunGetSecrets(ctx context.Context, f *util.Factory, out io.Writer, options *GetSecretsOptions) error {\n\tswitch strings.ToLower(options.Type) {\n\tcase \"\", \"secret\":\n\t// OK\n\tcase \"sshpublickey\":\n\t\treturn fmt.Errorf(\"use 'kops get sshpublickey' instead\")\n\tcase \"keypair\":\n\t\treturn fmt.Errorf(\"use 'kops get keypairs' instead\")\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown secret type %q\", options.Type)\n\t}\n\n\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tcluster, err := GetCluster(ctx, f, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\tsecretStore, err := clientset.SecretStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\titems, err := listSecrets(secretStore, options.SecretNames)\n\tif err != nil {","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_secrets.go#L92-L128","documentation":"RunGetSecrets only accepts --type values of \"\" (default), \"secret\", and historically sshpublickey/keypair. Any other value fails with 'unknown secret type %q', quoting the invalid type. This is a strict allowlist validation of the --type flag.","triggerScenarios":"Running `kops get secrets --type <something>` where something is not one of \"\", \"secret\", \"sshpublickey\", or \"keypair\" — e.g. a typo like `--type Secrett`, `--type tls`, or `--type passwords`.","commonSituations":"Typos in scripts; guessing flag values without checking `kops get secrets --help`; mixing up kops secret types with Kubernetes Secret types.","solutions":["Use `kops get secrets --help` to see valid --type values","Omit --type entirely to list default secrets","Fix the typo (valid values: \"secret\"; use the dedicated subcommands for other key material)"],"exampleFix":"// before\nkops get secrets --type passwords\n\n// after\nkops get secrets --type secret","handlingStrategy":"validation","validationCode":"case \"$(echo \"$SECRET_TYPE\" | tr '[:upper:]' '[:lower:]')\" in\n  \"\"|secret|sshpublickey|keypair) ;;\n  *) echo \"unknown secret type: $SECRET_TYPE\"; exit 1 ;;\nesac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use --type values documented in `kops get secrets --help`","Avoid free-form type strings in scripts","Prefer dedicated subcommands over --type where available"],"tags":["cli","kops","invalid-flag-value","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}