json output format is not (currently) supported for secrets

Error message

json output format is not (currently) supported for secrets

What it means

RunGetSecrets has table and plaintext output paths, but the yaml and json branches intentionally return errors because the structured serializers are not implemented for secrets. This is the json branch: a known capability gap, not a data problem.

Source

Thrown at cmd/kops/get_secrets.go:147

		return err
	}

	if len(items) == 0 {
		return fmt.Errorf("no secrets found")
	}
	switch options.Output {

	case OutputTable:
		t := &tables.Table{}
		t.AddColumn("NAME", func(i string) string {
			return i
		})
		return t.Render(items, out, "NAME")

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}
		}
		return nil

View on GitHub (pinned to 4c8573c808)

Solutions

Use `-o plaintext` to dump secret values
Use the default table output
For programmatic access, use the kops Go clientset (f.KopsClient()) rather than parsing CLI output

Example fix

// before
kops get secrets -o json | jq .

// after
kops get secrets -o plaintext

Defensive patterns

Strategy: validation

Validate before calling

if [ "$OUTPUT" = "json" ]; then
  echo "json output not supported for secrets"; OUTPUT=plaintext; fi

Prevention

Use plaintext output for machine parsing of secret values
Use the kops Go clientset for structured/JSON access instead of CLI output

When it happens

Trigger: Running `kops get secrets -o json` (or --output json).

Common situations: Scripts that pipe all `kops get` output through jq; users expecting parity with `kops get clusters -o json`.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4acf758a6c32c0cb. Report an issue: GitHub.