What causes "Secret not found: %q" in kubernetes/kops?

Run `kops get secrets` (ListSecrets) to see available secret names and confirm exact spelling

Secret not found: %q

Error message

Secret not found: %q

What it means

This error is returned by ClientsetSecretStore.Secret when FindSecret (backed by loadSecret) returns nil, meaning no Keyset named token-<name> of type SecretTypeSecret with primary key material exists in the namespace. Unlike FindSecret, which returns (nil, nil) for missing secrets, Secret treats absence as a hard error. It indicates the requested secret name does not exist in the cluster's keyset store.

Source

Thrown at upup/pkg/fi/secrets/clientset_secretstore.go:142

		keyset := &list.Items[i]

		if keyset.Spec.Type == kops.SecretTypeSecret {
			name := strings.TrimPrefix(keyset.Name, NamePrefix)
			names = append(names, name)
		}
	}

	return names, nil
}

// Secret implements fi.SecretStore::Secret
func (c *ClientsetSecretStore) Secret(name string) (*fi.Secret, error) {
	s, err := c.FindSecret(name)
	if err != nil {
		return nil, err
	}
	if s == nil {
		return nil, fmt.Errorf("Secret not found: %q", name)
	}
	return s, nil
}

// DeleteSecret implements fi.SecretStore::DeleteSecret
func (c *ClientsetSecretStore) DeleteSecret(name string) error {
	ctx := context.TODO()

	client := c.clientset.Keysets(c.namespace)

	keyset, err := client.Get(ctx, name, metav1.GetOptions{})
	if err != nil {
		if errors.IsNotFound(err) {
			return nil
		}
		return fmt.Errorf("error reading Keyset %q: %v", name, err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Run `kops get secrets` (ListSecrets) to see available secret names and confirm exact spelling
Check you are targeting the right cluster and namespace (correct kubeconfig/--name/--namespace)
If the secret was deleted unintentionally, recreate it (kops create secret / GetOrCreateSecret)
If the keyset exists but has no primary key, delete and recreate the keyset object

Example fix

// before: hard error on lookup
s, err := store.Secret("admin")
// after: use FindSecret when absence is acceptable
s, err := store.FindSecret("admin")
if err != nil { return err }
if s == nil {
    klog.Infof("secret %q not found; creating", "admin")
    s, _, err = store.GetOrCreateSecret(ctx, "admin", fi.NewSecret())
    if err != nil { return err }
}

Defensive patterns

Strategy: validation

Validate before calling

// check existence first via FindSecret/listing before requiring the secret
names, err := store.ListSecrets()
if err != nil { return err }
found := false
for _, n := range names {
    if n == wantName { found = true; break }
}
if !found { return fmt.Errorf("secret %q does not exist; available: %v", wantName, names) }

Type guard

func secretExists(store fi.SecretStore, name string) bool {
    s, err := store.FindSecret(name)
    return err == nil && s != nil
}

Try / catch

s, err := store.Secret(name)
if err != nil && strings.Contains(err.Error(), "Secret not found") {
    s, _, err = store.GetOrCreateSecret(ctx, name, fi.NewSecret())
}
if err != nil { return err }

Prevention

List secrets (kops get secrets) before referencing a secret by name
Use FindSecret/GetOrCreateSecret when absence is an expected state
Double-check secret names for typos; names are prefixed internally with 'token-'
Verify you target the right cluster and namespace — secrets are per-cluster

When it happens

Trigger: Calling Secret(name) where the Keyset 'token-<name>' was never created, was already deleted via DeleteSecret, the name is misspelled, or the keyset exists but has no primary key entry (FindPrimary returns nil).

Common situations: Typo in the secret name passed to `kops get secret <name>`; secret deleted by rotation/cleanup tooling; querying the wrong namespace or wrong cluster's API server; a partially created keyset with no primary material.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/147d4d96f4f1b9de. Report an issue: GitHub.