kubernetes/kops · error

cannot find secret %q

Error message

cannot find secret %q

What it means

FindSecret returns (nil, nil) when a secret name is known to the list but cannot be found in the store. RunGetSecrets detects this nil-secret case and returns `cannot find secret %q` so plaintext output never prints a nil dereference or empty value.

Source

Thrown at cmd/kops/get_secrets.go:156

		t := &tables.Table{}
		t.AddColumn("NAME", func(i string) string {
			return i
		})
		return t.Render(items, out, "NAME")

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}
		}
		return nil

	default:
		return fmt.Errorf("unknown output format: %q", options.Output)
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops get secrets` to refresh the listing and confirm the secret still exists
2. Recreate the secret with `kops create secret` if it was deleted
3. Verify you are pointed at the correct cluster/state store

Example fix

// before
kops get secrets -o plaintext deleted-secret

// after
kops create secret generic deleted-secret --name mycluster.example.com
kops get secrets -o plaintext deleted-secret

items, err := listSecrets(store, names)
if err != nil { return err }
for _, want := range names {
	found := false
	for _, have := range items {
		if have == want { found = true; break }
	}
	if !found { return fmt.Errorf("secret %q not in listing", want) }
}

func secretExists(store fi.SecretStore, name string) bool {
	s, err := store.FindSecret(name)
	return err == nil && s != nil
}

secret, err := secretStore.FindSecret(item)
if err != nil {
	return err
}
if secret == nil {
	return fmt.Errorf("cannot find secret %q (may have been deleted concurrently)", item)
}

When it happens

Trigger: Running `kops get secrets -o plaintext <name>` where the name appears in ListSecrets results but FindSecret returns nil — typically a stale list, a secret deleted concurrently, or a store backend inconsistency.

Common situations: Secret deleted by another operator between listing and reading; state store eventually-consistent backend returning stale listing; typo'd name passed while other names were listed without filter.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• cluster %q not found
• no secrets found
• getting secret %q: %v
• instanceGroup: %v does not exist (try adding --force flag)
• must specify %q label with cluster name to create instanceGr

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d62cd46bf35de89f. Report an issue: GitHub.