{"record":{"id":"f16a30bd142d494e","repo":"kubernetes/kops","slug":"getting-secret-q-v","errorCode":null,"errorMessage":"getting secret %q: %v","messagePattern":"getting secret %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_secrets.go","lineNumber":153,"sourceCode":"\tswitch options.Output {\n\n\tcase OutputTable:\n\t\tt := &tables.Table{}\n\t\tt.AddColumn(\"NAME\", func(i string) string {\n\t\t\treturn i\n\t\t})\n\t\treturn t.Render(items, out, \"NAME\")\n\n\tcase OutputYaml:\n\t\treturn fmt.Errorf(\"yaml output format is not (currently) supported for secrets\")\n\tcase OutputJSON:\n\t\treturn fmt.Errorf(\"json output format is not (currently) supported for secrets\")\n\tcase \"plaintext\":\n\t\tfor _, item := range items {\n\t\t\tvar data string\n\t\t\tsecret, err := secretStore.FindSecret(item)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"getting secret %q: %v\", item, err)\n\t\t\t}\n\t\t\tif secret == nil {\n\t\t\t\treturn fmt.Errorf(\"cannot find secret %q\", item)\n\t\t\t}\n\t\t\tdata = string(secret.Data)\n\n\t\t\t_, err = fmt.Fprintf(out, \"%s\\n\", data)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"writing output: %v\", err)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown output format: %q\", options.Output)\n\t}\n}\n","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_secrets.go#L135-L171","documentation":"In plaintext output mode, each listed secret name is fetched with secretStore.FindSecret(item). If that call returns an error (as opposed to nil), it is wrapped as `getting secret %q: %v`. This indicates a failure reading an individual secret from the store, distinct from the secret simply not existing.","triggerScenarios":"Running `kops get secrets -o plaintext` where FindSecret fails for one of the listed items — e.g. transient state-store read error, permission denied on the object, or corruption/IO error in the backing store.","commonSituations":"Race where the secret was deleted between ListSecrets and FindSecret; storage backend outage mid-command; insufficient IAM permissions on individual secret objects.","solutions":["Read the wrapped error after 'getting secret' to identify the root cause","Re-run the command to rule out a transient store error","Verify permissions to read secret objects in the state store","Re-list secrets to check the item still exists"],"exampleFix":"// before\nsecret, err := secretStore.FindSecret(item)\nif err != nil {\n\treturn fmt.Errorf(\"getting secret %q: %v\", item, err)\n}\n\n// after\nsecret, err := secretStore.FindSecret(item)\nif err != nil {\n\treturn fmt.Errorf(\"getting secret %q: %w\", item, err) // %w enables errors.Is/As unwrapping\n}","handlingStrategy":"try-catch","validationCode":"// ensure permissions/store reachable before bulk plaintext dump:\nitems, err := secretStore.ListSecrets()\nif err != nil { return err }","typeGuard":null,"tryCatchPattern":"secret, err := secretStore.FindSecret(item)\nif err != nil {\n\tif isTransient(err) {\n\t\ttime.Sleep(retryDelay)\n\t\tsecret, err = secretStore.FindSecret(item)\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting secret %q: %w\", item, err)\n\t}\n}","preventionTips":["Avoid modifying/deleting secrets while a plaintext dump is running","Ensure IAM permissions cover reading individual secret objects","Retry on transient storage errors"],"tags":["cli","kops","secret-store","wrapped-error"],"backgroundTag":"state-store-read-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}