kubernetes/kops · error

getting secret

Error message

getting secret %q: %v

What it means

In plaintext output mode, each listed secret name is fetched with secretStore.FindSecret(item). If that call returns an error (as opposed to nil), it is wrapped as `getting secret %q: %v`. This indicates a failure reading an individual secret from the store, distinct from the secret simply not existing.

Solutions

1. Read the wrapped error after 'getting secret' to identify the root cause
2. Re-run the command to rule out a transient store error
3. Verify permissions to read secret objects in the state store
4. Re-list secrets to check the item still exists

Example fix

// before
secret, err := secretStore.FindSecret(item)
if err != nil {
	return fmt.Errorf("getting secret %q: %v", item, err)
}

// after
secret, err := secretStore.FindSecret(item)
if err != nil {
	return fmt.Errorf("getting secret %q: %w", item, err) // %w enables errors.Is/As unwrapping
}

// ensure permissions/store reachable before bulk plaintext dump:
items, err := secretStore.ListSecrets()
if err != nil { return err }

secret, err := secretStore.FindSecret(item)
if err != nil {
	if isTransient(err) {
		time.Sleep(retryDelay)
		secret, err = secretStore.FindSecret(item)
	}
	if err != nil {
		return fmt.Errorf("getting secret %q: %w", item, err)
	}
}

When it happens

Trigger: Running `kops get secrets -o plaintext` where FindSecret fails for one of the listed items — e.g. transient state-store read error, permission denied on the object, or corruption/IO error in the backing store.

Common situations: Race where the secret was deleted between ListSecrets and FindSecret; storage backend outage mid-command; insufficient IAM permissions on individual secret objects.

Related errors

• cannot find secret
• listing secrets
• adding encryptionconfig secret
• adding keypair to is not supported
• can only delete one instance group at a time

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f16a30bd142d494e. Report an issue: GitHub.

Appendix: source

Thrown at cmd/kops/get_secrets.go:153

	switch options.Output {

	case OutputTable:
		t := &tables.Table{}
		t.AddColumn("NAME", func(i string) string {
			return i
		})
		return t.Render(items, out, "NAME")

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}
		}
		return nil

	default:
		return fmt.Errorf("unknown output format: %q", options.Output)
	}
}

View on GitHub (pinned to 4c8573c808)