kubernetes/kops · error

error listing secrets directory: %v

Error message

error listing secrets directory: %v

What it means

ListSecrets enumerates the store by calling ReadDir on the secrets basedir. A missing directory is treated as an empty list (os.IsNotExist is tolerated), but any other ReadDir failure is wrapped as 'error listing secrets directory'. This wraps all storage-level read errors from the underlying VFS implementation.

Source

Thrown at upup/pkg/fi/secrets/vfs_secretstore.go:105

	return nil
}

// DeleteSecret implements fi.SecretStore DeleteSecret
func (c *VFSSecretStore) DeleteSecret(name string) error {
	ctx := context.TODO()

	p := c.buildSecretPath(name)
	return p.Remove(ctx)
}

func (c *VFSSecretStore) ListSecrets() ([]string, error) {
	files, err := c.basedir.ReadDir()
	var ids []string
	if os.IsNotExist(err) {
		return ids, nil
	}
	if err != nil {
		return nil, fmt.Errorf("error listing secrets directory: %v", err)
	}
	for _, f := range files {
		id := f.Base()
		ids = append(ids, id)
	}
	return ids, nil
}

func (c *VFSSecretStore) GetOrCreateSecret(ctx context.Context, id string, secret *fi.Secret) (*fi.Secret, bool, error) {
	p := c.buildSecretPath(id)

	for i := 0; i < 2; i++ {
		s, err := c.FindSecret(id)
		if err != nil {
			return nil, false, err
		}

		if s != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops get secrets` to reproduce and see the raw cause
2. Fix credentials/IAM: ensure list permission on the secrets prefix
3. Verify connectivity to the storage backend (proxy, VPN, DNS)
4. Correct KOPS_STATE_STORE / basedir if the path is malformed

Example fix

// before: missing ListBucket permission
secrets, err := store.ListSecrets() // error listing secrets directory: ListObjects AccessDenied
// after: attach policy granting s3:ListBucket on the secrets bucket
// aws iam attach-role-policy --role-name kops --policy-arn arn:aws:iam::...:policy/kops-list
secrets, err := store.ListSecrets()

// Confirm listing works before depending on it
ids, err := store.ListSecrets()
if err != nil { return fmt.Errorf("fix storage access first: %v", err) }

ids, err := store.ListSecrets()
if err != nil {
    if strings.Contains(err.Error(), "error listing secrets directory") {
        // missing-dir is tolerated upstream; treat as storage/permission issue
        return diagnoseVFSAccess(store.VFSPath(), err)
    }
    return err
}

When it happens

Trigger: ReadDir fails for reasons other than NotExist: permission denied on the bucket/prefix, network timeout to object storage, invalid VFS path scheme, or a HEAD/LIST API error from S3/GCS.

Common situations: Expired AWS session tokens, IAM policy without s3:ListBucket on the secrets prefix, offline/VPN-down workstation against a remote state store, misconfigured KOPS_STATE_STORE URL.

Related errors

• error writing secret to %q: %v
• error listing secrets for mirror: %v
• error reading addons from %q: %v
• error loading secret %q: %w
• cannot parse SecretStore %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8de5d5f7028febf7. Report an issue: GitHub.