kubernetes/kops · error

unknown secret type %q

Error message

unknown secret type %q

What it means

RunGetSecrets only accepts --type values of "" (default), "secret", and historically sshpublickey/keypair. Any other value fails with 'unknown secret type %q', quoting the invalid type. This is a strict allowlist validation of the --type flag.

Source

Thrown at cmd/kops/get_secrets.go:110

				matches = append(matches, item)
			}
		}
		items = matches
	}

	return items, nil
}

func RunGetSecrets(ctx context.Context, f *util.Factory, out io.Writer, options *GetSecretsOptions) error {
	switch strings.ToLower(options.Type) {
	case "", "secret":
	// OK
	case "sshpublickey":
		return fmt.Errorf("use 'kops get sshpublickey' instead")
	case "keypair":
		return fmt.Errorf("use 'kops get keypairs' instead")
	default:
		return fmt.Errorf("unknown secret type %q", options.Type)
	}

	clientset, err := f.KopsClient()
	if err != nil {
		return err
	}

	cluster, err := GetCluster(ctx, f, options.ClusterName)
	if err != nil {
		return err
	}
	secretStore, err := clientset.SecretStore(cluster)
	if err != nil {
		return err
	}

	items, err := listSecrets(secretStore, options.SecretNames)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use `kops get secrets --help` to see valid --type values
2. Omit --type entirely to list default secrets
3. Fix the typo (valid values: "secret"; use the dedicated subcommands for other key material)

Example fix

// before
kops get secrets --type passwords

// after
kops get secrets --type secret

case "$(echo "$SECRET_TYPE" | tr '[:upper:]' '[:lower:]')" in
  ""|secret|sshpublickey|keypair) ;;
  *) echo "unknown secret type: $SECRET_TYPE"; exit 1 ;;
esac

When it happens

Trigger: Running `kops get secrets --type <something>` where something is not one of "", "secret", "sshpublickey", or "keypair" — e.g. a typo like `--type Secrett`, `--type tls`, or `--type passwords`.

Common situations: Typos in scripts; guessing flag values without checking `kops get secrets --help`; mixing up kops secret types with Kubernetes Secret types.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• spec.PublicKey is required
• adding keypair to %q is not supported
• unable to parse YAML %v: %v
• error adding SSH public key: %v
• parsing file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9f2749cbeb1cdc42. Report an issue: GitHub.