{"record":{"id":"f586607cd1ec0916","repo":"kubernetes/kops","slug":"error-loading-secret-q-w","errorCode":null,"errorMessage":"error loading secret %q: %w","messagePattern":"error loading secret %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/pkg/server/node_config.go","lineNumber":106,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"building nodeConfig for instanceGroup: %w\", err)\n\t\t}\n\t\tnodeupConfig, err := json.Marshal(bootstrapData.NodeupConfig)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"marshalling nodeupConfig: %w\", err)\n\t\t}\n\t\tnodeConfig = &nodeup.NodeConfig{}\n\t\tnodeConfig.NodeupConfig = string(nodeupConfig)\n\t}\n\n\t{\n\t\tsecretIDs := []string{\n\t\t\t\"dockerconfig\",\n\t\t}\n\t\tnodeConfig.NodeSecrets = make(map[string][]byte)\n\t\tfor _, id := range secretIDs {\n\t\t\tsecret, err := s.secretStore.FindSecret(id)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading secret %q: %w\", id, err)\n\t\t\t}\n\t\t\tif secret != nil && secret.Data != nil {\n\t\t\t\tnodeConfig.NodeSecrets[id] = secret.Data\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nodeConfig, nil\n}\n\n// buildInstanceGroupFromCAPI builds an InstanceGroup from a CAPI Machine, for building bootstrap data.\n// It builds a minimal instanceGroup, because many fields (e.g. image, machineType, minSize, maxSize)\n// are not relevant for building the bootstrap data.\nfunc (s *Server) buildInstanceGroupFromCAPI(ctx context.Context, capiMachine *clusterapi.Machine) (*kops.InstanceGroup, error) {\n\tlog := klog.FromContext(ctx)\n\n\tcapiDeploymentName := capiMachine.GetDeploymentName()\n\tif capiDeploymentName == \"\" {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/node_config.go#L88-L124","documentation":"getNodeConfig loads a fixed set of node secrets (e.g. dockerconfig) from the server's secretStore and attaches them to the NodeConfig. This error wraps a FindSecret failure, meaning the VFS-backed secret store could not read one of the required secrets.","triggerScenarios":"s.secretStore.FindSecret(id) returns a non-nil error for one of secretIDs (dockerconfig etc.), typically a VFS read error, missing store path, or permission problem.","commonSituations":"--secret-store misconfigured or points to a location without the secrets; storage backend (S3/GCS) credentials missing; secrets deleted or never created by kops create secret.","solutions":["Check the wrapped error for the specific VFS/backend failure","Verify --secret-store path matches the cluster's configuration","Recreate missing secrets with kops create secret (e.g. dockerconfig)","Verify controller IAM/storage credentials can read the secret store"],"exampleFix":"// before\nkops-controller --secret-store=s3://wrong-bucket/secrets\n// after\nkops-controller --secret-store=s3://correct-bucket/<cluster>/secrets","handlingStrategy":"try-catch","validationCode":"for _, id := range secretIDs {\n    if _, err := secretStore.FindSecret(id); err != nil {\n        return fmt.Errorf(\"precheck secret %q: %w\", id, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"secret, err := s.secretStore.FindSecret(id)\nif err != nil {\n    return nil, fmt.Errorf(\"error loading secret %q: %w\", id, err)\n}","preventionTips":["Create all node secrets with kops create secret before node registration","Grant controller IAM/storage permissions to read the secret store","Confirm --secret-store path matches cluster configuration"],"tags":["go","secrets","vfs","bootstrap"],"backgroundTag":"secret-store-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}