kubernetes/kops · error

getting secret %q: %v

Error message

getting secret %q: %v

What it means

In plaintext output mode, each listed secret name is fetched with secretStore.FindSecret(item). If that call returns an error (as opposed to nil), it is wrapped as `getting secret %q: %v`. This indicates a failure reading an individual secret from the store, distinct from the secret simply not existing.

Source

Thrown at cmd/kops/get_secrets.go:153

	switch options.Output {

	case OutputTable:
		t := &tables.Table{}
		t.AddColumn("NAME", func(i string) string {
			return i
		})
		return t.Render(items, out, "NAME")

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}
		}
		return nil

	default:
		return fmt.Errorf("unknown output format: %q", options.Output)
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error after 'getting secret' to identify the root cause
2. Re-run the command to rule out a transient store error
3. Verify permissions to read secret objects in the state store
4. Re-list secrets to check the item still exists

Example fix

// before
secret, err := secretStore.FindSecret(item)
if err != nil {
	return fmt.Errorf("getting secret %q: %v", item, err)
}

// after
secret, err := secretStore.FindSecret(item)
if err != nil {
	return fmt.Errorf("getting secret %q: %w", item, err) // %w enables errors.Is/As unwrapping
}

// ensure permissions/store reachable before bulk plaintext dump:
items, err := secretStore.ListSecrets()
if err != nil { return err }

secret, err := secretStore.FindSecret(item)
if err != nil {
	if isTransient(err) {
		time.Sleep(retryDelay)
		secret, err = secretStore.FindSecret(item)
	}
	if err != nil {
		return fmt.Errorf("getting secret %q: %w", item, err)
	}
}

When it happens

Trigger: Running `kops get secrets -o plaintext` where FindSecret fails for one of the listed items — e.g. transient state-store read error, permission denied on the object, or corruption/IO error in the backing store.

Common situations: Race where the secret was deleted between ListSecrets and FindSecret; storage backend outage mid-command; insufficient IAM permissions on individual secret objects.

Related errors

• listing secrets %v
• cannot find secret %q
• must specify %q label with cluster name to create instanceGr
• error querying cluster %q: %v
• cluster %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f16a30bd142d494e. Report an issue: GitHub.