{"record":{"id":"eaaec1cdcafce4dc","repo":"kubernetes/kops","slug":"getting-data-from-secret-w","errorCode":null,"errorMessage":"getting data from secret: %w","messagePattern":"getting data from secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/dump/resourcedumper.go","lineNumber":275,"sourceCode":"\t\tif err != nil {\n\t\t\tresults <- resourceDumpResult{\n\t\t\t\terr: fmt.Errorf(\"encoding resources for %v: %w\", job, err),\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tresults <- resourceDumpResult{}\n\t}\n}\n\nfunc maskObject(obj runtime.Object) error {\n\tif obj.GetObjectKind().GroupVersionKind() == (schema.GroupVersionKind{Group: \"\", Version: \"v1\", Kind: \"Secret\"}) {\n\t\tunstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdata, ok, err := unstructured.NestedMap(unstructuredObj, \"data\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting data from secret: %w\", err)\n\t\t}\n\t\tif ok {\n\t\t\tfor k := range data {\n\t\t\t\tdata[k] = \"REDACTED\"\n\t\t\t}\n\t\t\tunstructured.SetNestedMap(unstructuredObj, data, \"data\")\n\t\t}\n\n\t}\n\treturn nil\n}\n","sourceCodeStart":257,"sourceCodeEnd":287,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/dump/resourcedumper.go#L257-L287","documentation":"This error is returned by maskObject when unstructured.NestedMap fails to extract the `data` field from a Secret that was converted to an unstructured object. NestedMap returns an error only when an intermediate element in the path is not a map — i.e. the object's `data` field exists but is not a map[string]interface{}, which violates the Kubernetes Secret schema. It indicates the in-memory Secret object is malformed or of unexpected shape.","triggerScenarios":"A runtime.Object whose GroupVersionKind is core/v1 Secret is passed to maskObject; runtime.DefaultUnstructuredConverter.ToUnstructured succeeds, but unstructured.NestedMap(unstructuredObj, \"data\") returns an error because the value at key \"data\" is a non-map type (e.g. a string or list), which cannot occur for a schema-valid Secret but can occur with hand-crafted or corrupted objects.","commonSituations":"Dumping clusters containing Secrets mutated by non-standard controllers or admission webhooks that wrote a non-object `data` field; test fixtures with hand-built Secret objects; version skew where an older/incorrect client constructed the Secret type.","solutions":["Inspect the offending Secret (kubectl get secret <name> -o yaml) and fix its `data` field so it is a map of string→string.","Identify the controller or webhook that produced the malformed Secret and correct it; re-apply the Secret from its canonical manifest.","If constructing Secrets in code/tests, set Data via the typed corev1.Secret.Data map field rather than assigning arbitrary types to `data`.","As a defensive measure in custom builds, validate the `data` field is a map before dumping, and skip masking (or log a warning) instead of failing the whole dump."],"exampleFix":"// before: failing the entire dump when data is not a map\ndata, ok, err := unstructured.NestedMap(unstructuredObj, \"data\")\nif err != nil {\n    return fmt.Errorf(\"getting data from secret: %w\", err)\n}\n// after: treat a non-map `data` as an unexpected shape, warn and skip masking\ndata, ok, err := unstructured.NestedMap(unstructuredObj, \"data\")\nif err != nil {\n    klog.Warningf(\"secret %s/%s has non-map data field, not masking: %v\", unstructuredObj[\"metadata\"], unstructuredObj[\"name\"], err)\n    return nil\n}","handlingStrategy":"validation","validationCode":"// validate the Secret's data field is a map before masking/dumping\nfunc hasMapData(obj runtime.Object) bool {\n    u, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)\n    if err != nil {\n        return false\n    }\n    v, found, err := unstructured.NestedFieldNoCopy(u, \"data\")\n    if err != nil || !found {\n        return !found // missing data is fine (ok==false path)\n    }\n    _, isMap := v.(map[string]interface{})\n    return isMap\n}","typeGuard":null,"tryCatchPattern":"// caller of maskObject via EachListItem: catch and surface which secret failed\nerr := resourceList.EachListItem(func(obj runtime.Object) error {\n    if mErr := maskObject(obj); mErr != nil {\n        return fmt.Errorf(\"masking %T failed: %w\", obj, mErr)\n    }\n    return nil\n})","preventionTips":["Only create Secrets through the Kubernetes API or typed corev1.Secret structs.","Audit mutating webhooks/controllers that touch Secret.data.","Validate hand-built test fixtures with client-go scheme validation before dumping.","Skip-and-log instead of hard-failing the dump on schema anomalies in custom builds."],"tags":["kubernetes","secret","unstructured","dump"],"backgroundTag":"secret-schema-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}