{"record":{"id":"ac6aa24856ac31f1","repo":"kubernetes/kops","slug":"error-listing-secrets-for-mirror-v","errorCode":null,"errorMessage":"error listing secrets for mirror: %v","messagePattern":"error listing secrets for mirror: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/secrets/vfs_secretstore.go","lineNumber":59,"sourceCode":"\tc := &VFSSecretStore{\n\t\tVFSSecretStoreReader: VFSSecretStoreReader{\n\t\t\tbasedir: basedir,\n\t\t},\n\t\tcluster: cluster,\n\t}\n\treturn c\n}\n\nfunc (c *VFSSecretStore) MirrorTo(ctx context.Context, basedir vfs.Path) error {\n\tif basedir.Path() == c.basedir.Path() {\n\t\tklog.V(2).Infof(\"Skipping mirror of secret store from %q to %q (same path)\", c.basedir, basedir)\n\t\treturn nil\n\t}\n\tklog.V(2).Infof(\"Mirroring secret store from %q to %q\", c.basedir, basedir)\n\n\tsecrets, err := c.ListSecrets()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error listing secrets for mirror: %v\", err)\n\t}\n\n\tfor _, name := range secrets {\n\t\tsecret, err := c.FindSecret(name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading secret %q for mirror: %v\", name, err)\n\t\t}\n\n\t\tif secret == nil {\n\t\t\treturn fmt.Errorf(\"unable to find secret %q for mirror\", name)\n\t\t}\n\n\t\tp := BuildVfsSecretPath(basedir, name)\n\n\t\tacl, err := acls.GetACL(ctx, p, c.cluster)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building acl for secret %q for mirror: %v\", name, err)\n\t\t}","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/secrets/vfs_secretstore.go#L41-L77","documentation":"VFSSecretStore.MirrorTo copies every secret from the store's VFS basedir to a target basedir. Before copying, it enumerates the source secrets with ListSecrets(); if that enumeration fails (the underlying ReadDir on the VFS path returns a non-NotExist error), the error is wrapped as 'error listing secrets for mirror'. This is a fail-fast guard: without a reliable listing, mirroring cannot proceed safely.","triggerScenarios":"Calling MirrorTo when the source VFS path (e.g. s3://cluster/pki/secrets, a GCS path, or a local dir) exists but ReadDir fails: no cloud credentials, network outage, permission denied on the bucket/prefix, or malformed VFS path. Notably os.IsNotExist is tolerated (returns empty list), so this error means a real read failure.","commonSituations":"Expired or missing AWS/GCP credentials (kops export/replace secrets against remote state), IAM policy revoking s3:ListBucket, DNS/proxy issues reaching object storage, or state store pointing at a deleted/renamed bucket.","solutions":["Verify credentials for the state store backend (e.g. `aws sts get-caller-identity`) and re-run","Check the secrets basedir is reachable and readable: `kops get secrets` or an aws s3 ls on the prefix","Inspect the wrapped %v cause; fix the underlying vfs/storage error (permissions, network, bucket existence)","If migrating, mirror from a machine that has read access to the cluster state store"],"exampleFix":"// before: mirroring with no credentials\nctx := context.Background()\nerr := store.MirrorTo(ctx, targetDir) // error listing secrets for mirror: AccessDenied\n// after: establish credentials first\nctx := context.Background()\nif _, err := awsConfig.LoadDefaultConfig(ctx); err != nil { return err }\nerr := store.MirrorTo(ctx, targetDir)","handlingStrategy":"try-catch","validationCode":"// Pre-check reachability of the secrets dir\nif _, err := store.ListSecrets(); err != nil {\n    return fmt.Errorf(\"secrets store unreachable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := store.MirrorTo(ctx, target); err != nil {\n    if strings.Contains(err.Error(), \"error listing secrets for mirror\") {\n        // inspect cause, fix credentials/network, retry once\n        return retryAfterCredentialRefresh(err)\n    }\n    return err\n}","preventionTips":["Verify cloud credentials (aws sts get-caller-identity / gcloud auth) before kops operations","Grant s3:ListBucket or GCS storage.objects.list on the state store prefix","Run `kops get secrets` as a smoke test before automation that mirrors secrets","Keep KOPS_STATE_STORE consistent between tooling runs"],"tags":["vfs","secrets","storage","mirror"],"backgroundTag":"vfs-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}