derailed/k9s · error

unable to find data section in secret description

Error message

unable to find data section in secret description

What it means

Thrown by Secret.Decode in internal/dao/secret.go when parsing the kubectl describe output of a Secret. The decoder splits the description at the literal '====' separator that kubectl prints just before the base64-encoded data block (layout pinned to kubectl v0.29.0 describe.go). If that marker is not present, the encoded section cannot be stripped and the decoded data cannot be appended, so the whole decode operation aborts.

Source

Thrown at internal/dao/secret.go:94

	if err := p.PrintObj(o, &buff); err != nil {
		slog.Error("PrintObj failed", slogs.Error, err)
		return "", err
	}

	return buff.String(), nil
}

// SetDecodeData toggles decode mode.
func (s *Secret) SetDecodeData(b bool) {
	s.decodeData = b
}

// Decode removes the encoded part from the secret's description and appends the
// secret's decoded data.
func (s *Secret) Decode(encodedDescription, path string) (string, error) {
	dataEndIndex := strings.Index(encodedDescription, "====")
	if dataEndIndex == -1 {
		return "", fmt.Errorf("unable to find data section in secret description")
	}

	dataEndIndex += 4
	if dataEndIndex >= len(encodedDescription) {
		return "", fmt.Errorf("data section in secret description is invalid")
	}

	// Remove the encoded part from k8s's describe API
	// More details about the reasoning of index: https://github.com/kubernetes/kubectl/blob/v0.29.0/pkg/describe/describe.go#L2542
	body := encodedDescription[0:dataEndIndex]

	o, err := s.Get(context.Background(), path)
	if err != nil {
		return "", err
	}
	data, err := ExtractSecrets(o)
	if err != nil {
		return "", err

View on GitHub (pinned to 2d3ccc6ba2)

Solutions

1. Verify the Secret actually carries data: kubectl get secret <name> -n <ns> -o jsonpath='{.data}'
2. Run kubectl describe secret <name> and confirm the Data block terminated by a '====' line is present
3. If the describe layout differs, switch to a k9s build that matches your cluster's kubectl describe version (the parser is pinned to kubectl v0.29.0 output)
4. As a workaround, view the raw secret (kubectl get secret <name> -o yaml) instead of the decoded describe view

Example fix

# before: secret with no data
apiVersion: v1
kind: Secret
metadata:
  name: empty-secret
type: Opaque

# after: secret with data so describe emits the ==== section
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
stringData:
  username: admin
  password: s3cr3t

// Before decoding, ensure the describe output actually carries a data section.
if !strings.Contains(encodedDescription, "====") {
    return encodedDescription, nil // fall back to the raw, non-decoded description
}
decoded, err := secretDAO.Decode(encodedDescription, path)

decoded, err := s.Decode(desc, path)
if err != nil {
    // degrade gracefully: show the undecoded describe output instead of failing the view
    slog.Warn("secret decode failed, showing raw description", slogs.Error, err)
    return desc, nil
}

When it happens

Trigger: Calling Secret.Decode (e.g. toggling decode mode on a Secret view in k9s) on describe output that contains no '====' substring: an empty Secret with no data/stringData keys, describe text produced by a custom or aggregated API server that does not follow the standard kubectl Secret describer, or a Kubernetes version whose describe format drops the Data section for empty secrets.

Common situations: Secrets created from Helm charts or manifests that only set labels/annotations but no data; managed clusters where the control plane returns a non-standard describe body; k9s built against a kubectl describe format that differs from the target cluster's version.

Related errors

• data section in secret description is invalid
• failed to decode table rows: %w
• expected Unstructured, but got %T
• node is cordoned
• namespace not ready

AI-assisted analysis of derailed/k9s@2d3ccc6ba2 (2026-08-15). Data as JSON: /api/errors/8e1c4bcec2e7edf0. Report an issue: GitHub.