kubernetes/kops · error

secret %q not found

Error message

secret %q not found

What it means

VFSSecretStoreReader.Secret() is the strict lookup: it calls FindSecret, which returns (nil, nil) when the secret file does not exist on VFS. Secret() converts that nil result into the error 'secret %q not found'. Unlike FindSecret, the absence of a secret is an error condition here, suitable for callers that require the secret.

Source

Thrown at upup/pkg/fi/secrets/vfs_secretstorereader.go:71

func (c *VFSSecretStoreReader) FindSecret(id string) (*fi.Secret, error) {
	ctx := context.TODO()

	p := c.buildSecretPath(id)
	s, err := c.loadSecret(ctx, p)
	if err != nil {
		return nil, err
	}
	return s, nil
}

func (c *VFSSecretStoreReader) Secret(id string) (*fi.Secret, error) {
	s, err := c.FindSecret(id)
	if err != nil {
		return nil, err
	}
	if s == nil {
		return nil, fmt.Errorf("secret %q not found", id)
	}
	return s, nil
}

func (c *VFSSecretStoreReader) loadSecret(ctx context.Context, p vfs.Path) (*fi.Secret, error) {
	data, err := p.ReadFile(ctx)
	if err != nil {
		if os.IsNotExist(err) {
			return nil, nil
		}
	}
	s := &fi.Secret{}
	err = json.Unmarshal(data, s)
	if err != nil {
		return nil, fmt.Errorf("parsing secret from %q: %v", p, err)
	}
	return s, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List available secrets with `kops get secrets` and correct the id
2. Verify KOPS_STATE_STORE and --name point at the intended cluster
3. Create the secret if it genuinely does not exist: `kops create secret <type> <id> ...`
4. Use FindSecret() in code when absence is an expected, non-error outcome

Example fix

// before
sec, err := reader.Secret("adimn") // secret "adimn" not found
// after
sec, err := reader.FindSecret("admin")
if err != nil { return err }
if sec == nil { return fmt.Errorf("create admin secret first") }

// Check existence with FindSecret before demanding the secret
sec, err := reader.FindSecret(id)
if err != nil { return err }
if sec == nil { return fmt.Errorf("secret %s must be created first (kops create secret)", id) }

func hasSecret(r fi.SecretStoreReader, id string) bool {
    s, err := r.FindSecret(id)
    return err == nil && s != nil
}

sec, err := reader.Secret(id)
if err != nil && strings.Contains(err.Error(), "not found") {
    return fmt.Errorf("secret %q missing; run `kops create secret` or fix the id (see `kops get secrets`)", id)
} else if err != nil {
    return err
}

When it happens

Trigger: Calling Secret(id) (directly or via kops commands like `kops get secret <id>`) with an id that has no corresponding file under the secrets basedir — wrong id spelling, secret deleted, or pointed at the wrong cluster's state store.

Common situations: `kops get secret admin` on a cluster where the admin secret was never created or was rotated away, using `kops toolbox dump`/automation against the wrong KOPS_STATE_STORE or cluster name, typos in secret ids in CI scripts.

Related errors

• error loading secret %q: %w
• cannot parse SecretStore %q: %w
• secret %q not found
• failed to find network %q
• secrets path is not cluster readable: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f60160d9dcc5516d. Report an issue: GitHub.