kubernetes/kops · error

listing secrets %v

Error message

listing secrets %v

What it means

listSecrets wraps any error returned by the secret store's ListSecrets() call with the 'listing secrets' prefix. This is a wrapped underlying error: the real cause (state store connectivity, permissions, missing state bucket) is in the %v suffix.

Source

Thrown at cmd/kops/get_secrets.go:84

			}

			return nil
		},
		ValidArgsFunction: completeSecretNames(f),
		RunE: func(cmd *cobra.Command, args []string) error {
			return RunGetSecrets(cmd.Context(), f, out, &options)
		},
	}

	cmd.Flags().StringVarP(&options.Type, "type", "", "", "Filter by secret type")
	cmd.Flags().MarkHidden("type")
	return cmd
}

func listSecrets(secretStore fi.SecretStore, names []string) ([]string, error) {
	items, err := secretStore.ListSecrets()
	if err != nil {
		return nil, fmt.Errorf("listing secrets %v", err)
	}

	if len(names) != 0 {
		nameSet := sets.NewString(names...)
		var matches []string
		for _, item := range items {
			if nameSet.Has(item) {
				matches = append(matches, item)
			}
		}
		items = matches
	}

	return items, nil
}

func RunGetSecrets(ctx context.Context, f *util.Factory, out io.Writer, options *GetSecretsOptions) error {
	switch strings.ToLower(options.Type) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error text after 'listing secrets' to find the root cause
2. Verify cloud credentials are valid (e.g. `aws sts get-caller-identity`)
3. Check the --state flag / KOPS_STATE_STORE env var points at the correct, existing store
4. Confirm IAM permissions allow reading the state store objects

Example fix

// before
items, err := secretStore.ListSecrets()
if err != nil {
	return nil, fmt.Errorf("listing secrets %v", err)
}

// after (caller-side diagnosis)
items, err := secretStore.ListSecrets()
if err != nil {
	return nil, fmt.Errorf("listing secrets: %w", err) // use %w to unwrap with errors.Is/As
}

// pre-check state store reachability in shell before running:
kops get clusters --name "$CLUSTER" >/dev/null || echo "state store unreachable"

items, err := listSecrets(store, names)
if err != nil {
	var cause error
	if errors.Unwrap(err) != nil {
		cause = errors.Unwrap(err)
	}
	log.Printf("secret listing failed: %v (cause: %v)", err, cause)
	return err
}

When it happens

Trigger: Calling `kops get secrets` when the underlying secret store (state store) cannot list secrets — e.g. the state store/S3 bucket is unreachable, credentials are missing or insufficient, or the cluster's secret store does not exist.

Common situations: Expired or absent AWS/GCP credentials; wrong --state flag pointing at a nonexistent bucket; network partition or DNS failure to the state store; IAM policy lacking read access to the state bucket.

Related errors

• error querying cluster %q: %v
• adding encryptionconfig secret: %v
• updating encryptionconfig secret: %v
• getting secret %q: %v
• no InstanceGroup objects found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e080b2021ea9d219. Report an issue: GitHub.