kubernetes/kops · error

secret %q not found

Error message

secret %q not found

What it means

configserverSecretStore.Secret wraps FindSecret and converts a nil result into a hard error when the requested secret ID does not exist in the config-server secret store. Unlike the reader variant, Secret() is expected to always return a secret, so absence is treated as failure. This means the secret was never created in the config server or the ID is wrong.

Source

Thrown at pkg/configserver/secretstore.go:43

// configserverSecretStore is a SecretStore backed by the config server.
type configserverSecretStore struct {
	nodeSecrets map[string][]byte
}

func NewSecretStore(nodeSecrets map[string][]byte) fi.SecretStoreReader {
	return &configserverSecretStore{
		nodeSecrets: nodeSecrets,
	}
}

// Secret implements fi.SecretStoreReader
func (s *configserverSecretStore) Secret(id string) (*fi.Secret, error) {
	secret, err := s.FindSecret(id)
	if err != nil {
		return nil, err
	}
	if secret == nil {
		return nil, fmt.Errorf("secret %q not found", id)
	}
	return secret, nil
}

// FindSecret implements fi.SecretStoreReader
func (s *configserverSecretStore) FindSecret(id string) (*fi.Secret, error) {
	secretBytes, ok := s.nodeSecrets[id]
	if !ok {
		return nil, nil
	}
	secret := &fi.Secret{
		Data: secretBytes,
	}
	return secret, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create/upload the missing secret to the config server before use
2. Verify the exact secret ID spelling and the state store the code is pointed at
3. Re-run the appropriate 'kops create secret' command to populate the secret

Example fix

// before
secret, err := secretStore.Secret("dockerconfig") // fails when absent
// after
secret, err := secretStore.FindSecret("dockerconfig")
if err != nil { return err }
if secret == nil { secret, err = createAndStoreSecret("dockerconfig") }

secret, err := store.FindSecret(id)
if err != nil { return err }
if secret == nil {
	return fmt.Errorf("secret %q missing; create it with 'kops create secret' first", id)
}

secret, err := store.Secret(id)
if err != nil && strings.Contains(err.Error(), "not found") {
	// create or upload the secret, then retry
	return createSecret(id)
}
if err != nil { return err }

When it happens

Trigger: Calling fi.SecretStore.Secret(id) where FindSecret returns (nil, nil) — i.e. no secret with that ID is stored in the config-server backend.

Common situations: Fresh cluster before secrets are uploaded to the config server; typo in secret ID; secrets lost after config-server state reset; running commands that assume a secret exists (e.g. docker pull-through, admin password lookups) without creating it first.

Related errors

• Secret not found: %q
• secret %q not found
• error loading secret %q: %w
• cannot parse SecretStore %q: %w
• cluster %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6db26c7406418120. Report an issue: GitHub.