{"record":{"id":"f60160d9dcc5516d","repo":"kubernetes/kops","slug":"secret-q-not-found-f60160","errorCode":null,"errorMessage":"secret %q not found","messagePattern":"secret %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/secrets/vfs_secretstorereader.go","lineNumber":71,"sourceCode":"\nfunc (c *VFSSecretStoreReader) FindSecret(id string) (*fi.Secret, error) {\n\tctx := context.TODO()\n\n\tp := c.buildSecretPath(id)\n\ts, err := c.loadSecret(ctx, p)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn s, nil\n}\n\nfunc (c *VFSSecretStoreReader) Secret(id string) (*fi.Secret, error) {\n\ts, err := c.FindSecret(id)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif s == nil {\n\t\treturn nil, fmt.Errorf(\"secret %q not found\", id)\n\t}\n\treturn s, nil\n}\n\nfunc (c *VFSSecretStoreReader) loadSecret(ctx context.Context, p vfs.Path) (*fi.Secret, error) {\n\tdata, err := p.ReadFile(ctx)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn nil, nil\n\t\t}\n\t}\n\ts := &fi.Secret{}\n\terr = json.Unmarshal(data, s)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing secret from %q: %v\", p, err)\n\t}\n\treturn s, nil\n}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/secrets/vfs_secretstorereader.go#L53-L89","documentation":"VFSSecretStoreReader.Secret() is the strict lookup: it calls FindSecret, which returns (nil, nil) when the secret file does not exist on VFS. Secret() converts that nil result into the error 'secret %q not found'. Unlike FindSecret, the absence of a secret is an error condition here, suitable for callers that require the secret.","triggerScenarios":"Calling Secret(id) (directly or via kops commands like `kops get secret <id>`) with an id that has no corresponding file under the secrets basedir — wrong id spelling, secret deleted, or pointed at the wrong cluster's state store.","commonSituations":"`kops get secret admin` on a cluster where the admin secret was never created or was rotated away, using `kops toolbox dump`/automation against the wrong KOPS_STATE_STORE or cluster name, typos in secret ids in CI scripts.","solutions":["List available secrets with `kops get secrets` and correct the id","Verify KOPS_STATE_STORE and --name point at the intended cluster","Create the secret if it genuinely does not exist: `kops create secret <type> <id> ...`","Use FindSecret() in code when absence is an expected, non-error outcome"],"exampleFix":"// before\nsec, err := reader.Secret(\"adimn\") // secret \"adimn\" not found\n// after\nsec, err := reader.FindSecret(\"admin\")\nif err != nil { return err }\nif sec == nil { return fmt.Errorf(\"create admin secret first\") }","handlingStrategy":"type-guard","validationCode":"// Check existence with FindSecret before demanding the secret\nsec, err := reader.FindSecret(id)\nif err != nil { return err }\nif sec == nil { return fmt.Errorf(\"secret %s must be created first (kops create secret)\", id) }","typeGuard":"func hasSecret(r fi.SecretStoreReader, id string) bool {\n    s, err := r.FindSecret(id)\n    return err == nil && s != nil\n}","tryCatchPattern":"sec, err := reader.Secret(id)\nif err != nil && strings.Contains(err.Error(), \"not found\") {\n    return fmt.Errorf(\"secret %q missing; run `kops create secret` or fix the id (see `kops get secrets`)\", id)\n} else if err != nil {\n    return err\n}","preventionTips":["Run `kops get secrets` to confirm ids before lookup","Confirm --name and KOPS_STATE_STORE target the right cluster","Use FindSecret in code when absence is normal","Document required secrets (admin, dockerconfig) in cluster bootstrap automation"],"tags":["secrets","not-found","vfs","lookup"],"backgroundTag":"secret-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}