What causes "error loading secret %q: %w" in kubernetes/kops?

Check the wrapped error for the specific VFS/backend failure

error loading secret %q: %w

Error message

error loading secret %q: %w

What it means

getNodeConfig loads a fixed set of node secrets (e.g. dockerconfig) from the server's secretStore and attaches them to the NodeConfig. This error wraps a FindSecret failure, meaning the VFS-backed secret store could not read one of the required secrets.

Source

Thrown at cmd/kops-controller/pkg/server/node_config.go:106

			return nil, fmt.Errorf("building nodeConfig for instanceGroup: %w", err)
		}
		nodeupConfig, err := json.Marshal(bootstrapData.NodeupConfig)
		if err != nil {
			return nil, fmt.Errorf("marshalling nodeupConfig: %w", err)
		}
		nodeConfig = &nodeup.NodeConfig{}
		nodeConfig.NodeupConfig = string(nodeupConfig)
	}

	{
		secretIDs := []string{
			"dockerconfig",
		}
		nodeConfig.NodeSecrets = make(map[string][]byte)
		for _, id := range secretIDs {
			secret, err := s.secretStore.FindSecret(id)
			if err != nil {
				return nil, fmt.Errorf("error loading secret %q: %w", id, err)
			}
			if secret != nil && secret.Data != nil {
				nodeConfig.NodeSecrets[id] = secret.Data
			}
		}
	}

	return nodeConfig, nil
}

// buildInstanceGroupFromCAPI builds an InstanceGroup from a CAPI Machine, for building bootstrap data.
// It builds a minimal instanceGroup, because many fields (e.g. image, machineType, minSize, maxSize)
// are not relevant for building the bootstrap data.
func (s *Server) buildInstanceGroupFromCAPI(ctx context.Context, capiMachine *clusterapi.Machine) (*kops.InstanceGroup, error) {
	log := klog.FromContext(ctx)

	capiDeploymentName := capiMachine.GetDeploymentName()
	if capiDeploymentName == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

Check the wrapped error for the specific VFS/backend failure
Verify --secret-store path matches the cluster's configuration
Recreate missing secrets with kops create secret (e.g. dockerconfig)
Verify controller IAM/storage credentials can read the secret store

Example fix

// before
kops-controller --secret-store=s3://wrong-bucket/secrets
// after
kops-controller --secret-store=s3://correct-bucket/<cluster>/secrets

Defensive patterns

Strategy: try-catch

Validate before calling

for _, id := range secretIDs {
    if _, err := secretStore.FindSecret(id); err != nil {
        return fmt.Errorf("precheck secret %q: %w", id, err)
    }
}

Try / catch

secret, err := s.secretStore.FindSecret(id)
if err != nil {
    return nil, fmt.Errorf("error loading secret %q: %w", id, err)
}

Prevention

Create all node secrets with kops create secret before node registration
Grant controller IAM/storage permissions to read the secret store
Confirm --secret-store path matches cluster configuration

When it happens

Trigger: s.secretStore.FindSecret(id) returns a non-nil error for one of secretIDs (dockerconfig etc.), typically a VFS read error, missing store path, or permission problem.

Common situations: --secret-store misconfigured or points to a location without the secrets; storage backend (S3/GCS) credentials missing; secrets deleted or never created by kops create secret.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f586607cd1ec0916. Report an issue: GitHub.