kubernetes/kops · error

error serializing secret: %v

Error message

error serializing secret: %v

What it means

This error is returned by ClientsetSecretStore.MirrorTo when json.Marshal fails to serialize a fi.Secret (whose Data is the keyset's primary PrivateMaterial) into JSON before writing it to the VFS path. It indicates the in-memory secret material could not be encoded, almost always due to an unsupported value inside the secret data map. It wraps the underlying encoding/json error with context about which operation failed.

Source

Thrown at upup/pkg/fi/secrets/clientset_secretstore.go:86

		if keyset.Spec.Type != kops.SecretTypeSecret {
			continue
		}

		primary := fi.FindPrimary(keyset)
		if primary == nil {
			return fmt.Errorf("found secret with no primary data: %s", keyset.Name)
		}

		name := strings.TrimPrefix(keyset.Name, NamePrefix)
		p := BuildVfsSecretPath(basedir, name)

		s := &fi.Secret{
			Data: primary.PrivateMaterial,
		}
		data, err := json.Marshal(s)
		if err != nil {
			return fmt.Errorf("error serializing secret: %v", err)
		}

		acl, err := acls.GetACL(ctx, p, c.cluster)
		if err != nil {
			return err
		}

		if err := p.WriteFile(ctx, bytes.NewReader(data), acl); err != nil {
			return fmt.Errorf("error writing secret to %q: %v", p, err)
		}
	}

	return nil
}

// FindSecret implements fi.SecretStore::FindSecret
func (c *ClientsetSecretStore) FindSecret(name string) (*fi.Secret, error) {
	ctx := context.TODO()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v error to identify the offending field/type in the secret data
2. Dump the Keyset (kubectl get keysets -o yaml in the cluster namespace) and check the primary key's PrivateMaterial for unexpected values
3. Fix or recreate the offending Keyset via `kops replace` or delete and recreate the secret (`kops delete secret`, then re-create it)
4. Re-run the mirror/export operation after the keyset is corrected

Example fix

// before: opaque failure mid-mirror
for _, keyset := range list.Items {
    data, err := json.Marshal(&fi.Secret{Data: primary.PrivateMaterial})
    if err != nil { return fmt.Errorf("error serializing secret: %v", err) }
}
// after: identify which secret failed to serialize
for _, keyset := range list.Items {
    data, err := json.Marshal(&fi.Secret{Data: primary.PrivateMaterial})
    if err != nil { return fmt.Errorf("error serializing secret %q: %v", keyset.Name, err) }
}

// validate secret data is JSON-encodable before mirroring
func encodable(data map[string][]byte) error {
    b, err := json.Marshal(map[string][]byte{"k": nil})
    _ = b
    for k, v := range data {
        if v == nil { continue }
        if len(v) == 0 { return fmt.Errorf("secret key %q has empty material", k) }
    }
    _ = err
    return nil
}

func hasPrimaryMaterial(keyset *kops.Keyset) bool {
    primary := fi.FindPrimary(keyset)
    return primary != nil && primary.PrivateMaterial != nil
}

err := store.MirrorTo(ctx, basedir)
if err != nil {
    if strings.Contains(err.Error(), "error serializing secret") {
        klog.Errorf("secret serialization failed; inspect keyset private material: %v", err)
        // fall back to skipping the offending keyset instead of aborting the mirror
    } else {
        return err
    }
}

When it happens

Trigger: MirrorTo iterates Keyset objects of type SecretTypeSecret; json.Marshal(&fi.Secret{Data: primary.PrivateMaterial}) fails, e.g. PrivateMaterial contains a value json cannot encode (channel, func, cycle) or the marshaler itself errors.

Common situations: A Keyset in the cluster API was created or mutated by tooling that stored non-JSON-serializable private material; corrupted or hand-edited keyset objects; a custom fi.Secret change introducing unencodable fields.

Understand the failure class

Background: "JSON serialization failed", "not JSON serializable", "Failed to serialize": why JSON marshaling errors happen and how to fix them — this error's family across 46 libraries.

Related errors

• unable to marshal JSON: %v
• marshaling cluster config: %w
• error serializing secret: %v
• error building annotation patch: %v
• building node patch: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/90b2b052c7f05d76. Report an issue: GitHub.