{"record":{"id":"e080b2021ea9d219","repo":"kubernetes/kops","slug":"listing-secrets-v","errorCode":null,"errorMessage":"listing secrets %v","messagePattern":"listing secrets (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_secrets.go","lineNumber":84,"sourceCode":"\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tValidArgsFunction: completeSecretNames(f),\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\treturn RunGetSecrets(cmd.Context(), f, out, &options)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVarP(&options.Type, \"type\", \"\", \"\", \"Filter by secret type\")\n\tcmd.Flags().MarkHidden(\"type\")\n\treturn cmd\n}\n\nfunc listSecrets(secretStore fi.SecretStore, names []string) ([]string, error) {\n\titems, err := secretStore.ListSecrets()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"listing secrets %v\", err)\n\t}\n\n\tif len(names) != 0 {\n\t\tnameSet := sets.NewString(names...)\n\t\tvar matches []string\n\t\tfor _, item := range items {\n\t\t\tif nameSet.Has(item) {\n\t\t\t\tmatches = append(matches, item)\n\t\t\t}\n\t\t}\n\t\titems = matches\n\t}\n\n\treturn items, nil\n}\n\nfunc RunGetSecrets(ctx context.Context, f *util.Factory, out io.Writer, options *GetSecretsOptions) error {\n\tswitch strings.ToLower(options.Type) {","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_secrets.go#L66-L102","documentation":"listSecrets wraps any error returned by the secret store's ListSecrets() call with the 'listing secrets' prefix. This is a wrapped underlying error: the real cause (state store connectivity, permissions, missing state bucket) is in the %v suffix.","triggerScenarios":"Calling `kops get secrets` when the underlying secret store (state store) cannot list secrets — e.g. the state store/S3 bucket is unreachable, credentials are missing or insufficient, or the cluster's secret store does not exist.","commonSituations":"Expired or absent AWS/GCP credentials; wrong --state flag pointing at a nonexistent bucket; network partition or DNS failure to the state store; IAM policy lacking read access to the state bucket.","solutions":["Read the wrapped error text after 'listing secrets' to find the root cause","Verify cloud credentials are valid (e.g. `aws sts get-caller-identity`)","Check the --state flag / KOPS_STATE_STORE env var points at the correct, existing store","Confirm IAM permissions allow reading the state store objects"],"exampleFix":"// before\nitems, err := secretStore.ListSecrets()\nif err != nil {\n\treturn nil, fmt.Errorf(\"listing secrets %v\", err)\n}\n\n// after (caller-side diagnosis)\nitems, err := secretStore.ListSecrets()\nif err != nil {\n\treturn nil, fmt.Errorf(\"listing secrets: %w\", err) // use %w to unwrap with errors.Is/As\n}","handlingStrategy":"try-catch","validationCode":"// pre-check state store reachability in shell before running:\nkops get clusters --name \"$CLUSTER\" >/dev/null || echo \"state store unreachable\"","typeGuard":null,"tryCatchPattern":"items, err := listSecrets(store, names)\nif err != nil {\n\tvar cause error\n\tif errors.Unwrap(err) != nil {\n\t\tcause = errors.Unwrap(err)\n\t}\n\tlog.Printf(\"secret listing failed: %v (cause: %v)\", err, cause)\n\treturn err\n}","preventionTips":["Validate cloud credentials before invoking kops","Pin --state / KOPS_STATE_STORE in scripts","Check IAM read permissions on the state bucket"],"tags":["cli","kops","state-store","wrapped-error"],"backgroundTag":"state-store-access-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}