kubernetes/kops · warning

getting data from secret: %w

Error message

getting data from secret: %w

What it means

This error is returned by maskObject when unstructured.NestedMap fails to extract the `data` field from a Secret that was converted to an unstructured object. NestedMap returns an error only when an intermediate element in the path is not a map — i.e. the object's `data` field exists but is not a map[string]interface{}, which violates the Kubernetes Secret schema. It indicates the in-memory Secret object is malformed or of unexpected shape.

Source

Thrown at pkg/dump/resourcedumper.go:275

		if err != nil {
			results <- resourceDumpResult{
				err: fmt.Errorf("encoding resources for %v: %w", job, err),
			}
			continue
		}
		results <- resourceDumpResult{}
	}
}

func maskObject(obj runtime.Object) error {
	if obj.GetObjectKind().GroupVersionKind() == (schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"}) {
		unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
		if err != nil {
			return err
		}
		data, ok, err := unstructured.NestedMap(unstructuredObj, "data")
		if err != nil {
			return fmt.Errorf("getting data from secret: %w", err)
		}
		if ok {
			for k := range data {
				data[k] = "REDACTED"
			}
			unstructured.SetNestedMap(unstructuredObj, data, "data")
		}

	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the offending Secret (kubectl get secret <name> -o yaml) and fix its `data` field so it is a map of string→string.
2. Identify the controller or webhook that produced the malformed Secret and correct it; re-apply the Secret from its canonical manifest.
3. If constructing Secrets in code/tests, set Data via the typed corev1.Secret.Data map field rather than assigning arbitrary types to `data`.
4. As a defensive measure in custom builds, validate the `data` field is a map before dumping, and skip masking (or log a warning) instead of failing the whole dump.

Example fix

// before: failing the entire dump when data is not a map
data, ok, err := unstructured.NestedMap(unstructuredObj, "data")
if err != nil {
    return fmt.Errorf("getting data from secret: %w", err)
}
// after: treat a non-map `data` as an unexpected shape, warn and skip masking
data, ok, err := unstructured.NestedMap(unstructuredObj, "data")
if err != nil {
    klog.Warningf("secret %s/%s has non-map data field, not masking: %v", unstructuredObj["metadata"], unstructuredObj["name"], err)
    return nil
}

// validate the Secret's data field is a map before masking/dumping
func hasMapData(obj runtime.Object) bool {
    u, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
    if err != nil {
        return false
    }
    v, found, err := unstructured.NestedFieldNoCopy(u, "data")
    if err != nil || !found {
        return !found // missing data is fine (ok==false path)
    }
    _, isMap := v.(map[string]interface{})
    return isMap
}

// caller of maskObject via EachListItem: catch and surface which secret failed
err := resourceList.EachListItem(func(obj runtime.Object) error {
    if mErr := maskObject(obj); mErr != nil {
        return fmt.Errorf("masking %T failed: %w", obj, mErr)
    }
    return nil
})

When it happens

Trigger: A runtime.Object whose GroupVersionKind is core/v1 Secret is passed to maskObject; runtime.DefaultUnstructuredConverter.ToUnstructured succeeds, but unstructured.NestedMap(unstructuredObj, "data") returns an error because the value at key "data" is a non-map type (e.g. a string or list), which cannot occur for a schema-valid Secret but can occur with hand-crafted or corrupted objects.

Common situations: Dumping clusters containing Secrets mutated by non-standard controllers or admission webhooks that wrote a non-object `data` field; test fixtures with hand-built Secret objects; version skew where an older/incorrect client constructed the Secret type.

Related errors

• error creating pod log dumper: %w
• applying kubeconfig secret to cluster: %w
• failed to create bootstrap data secret for KopsConfig %s/%s:
• failed to get bootstrap data secret: %w
• error encoding %T with unstructured encoder: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/eaaec1cdcafce4dc. Report an issue: GitHub.