kubernetes/kops · error

deleting secret %q: %v

Error message

deleting secret %q: %v

What it means

RunDeleteSecret iterates options.SecretNames and calls secretStore.DeleteSecret(name) for each. Any failure from the underlying secret store (not found, permissions, state store I/O) is wrapped as "deleting secret %q: %v" with the secret name and cause.

Source

Thrown at cmd/kops/delete_secret.go:114

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return err
	}

	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}

	for _, name := range options.SecretNames {
		err = secretStore.DeleteSecret(name)
		if err != nil {
			return fmt.Errorf("deleting secret %q: %v", name, err)
		}
	}

	return nil
}

func completeSecretNames(f commandutils.Factory) func(cmd *cobra.Command, args []string, complete string) ([]string, cobra.ShellCompDirective) {
	return func(cmd *cobra.Command, args []string, complete string) ([]string, cobra.ShellCompDirective) {
		ctx := cmd.Context()

		commandutils.ConfigureKlogForCompletion()

		cluster, clientSet, completions, directive := GetClusterForCompletion(ctx, f, nil)
		if cluster == nil {
			return completions, directive
		}

		secretStore, err := clientSet.SecretStore(cluster)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v for the root cause (not-found vs access vs I/O)
2. List secrets with `kops get secrets` to confirm the name exists
3. Check state store credentials/permissions (bucket write access) and retry

Example fix

// before
kops delete secret dockercfg --name mycluster.k8s.local
// after (use the exact name)
kops get secrets --name mycluster.k8s.local
kops delete secret dockerconfig --name mycluster.k8s.local

kops get secrets --name mycluster.k8s.local  # confirm the secret exists

err := RunDeleteSecret(ctx, f, out, opts)
if err != nil && strings.Contains(err.Error(), "deleting secret") {
    // parse wrapped cause; treat not-found as idempotent success
    log.Printf("secret delete failed: %v", err)
}

When it happens

Trigger: secretStore.DeleteSecret(name) returns an error: secret does not exist in the cluster's secret store, state store backend is unreachable, or credentials lack write access.

Common situations: Deleting a secret that was already removed; read-only or missing permissions on the S3/GCS state store; typos in the secret name matching nothing.

Related errors

• error creating cluster: %v
• error querying cluster %q: %v
• error writing additional objects: %v
• cluster %q already exists; use 'kops update cluster' to appl
• error writing updated configuration: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/db1c642eaacc0f6c. Report an issue: GitHub.