kubernetes/kops · error

writing output: %v

Error message

writing output: %v

What it means

In kOps' `kops get secrets` command, after fetching a secret from the keyStore the raw data is printed to the command output with fmt.Fprintf. If that write fails (e.g. the output stream was closed, or a file-backed writer hit an I/O error), the command wraps the underlying error as "writing output: %v" and aborts RunGetSecrets.

Source

Thrown at cmd/kops/get_secrets.go:162

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}
		}
		return nil

	default:
		return fmt.Errorf("unknown output format: %q", options.Output)
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the downstream consumer of the pipe: re-run without `| head`/`| less`, or use `kops get secrets ... | cat`
2. Verify disk space and write permissions on the redirect target (df -h, ls -l)
3. Check the wrapped error text after 'writing output:' for the actual cause (broken pipe vs permission denied)
4. If piping is intentional, ignore EPIPE: run `kops get secrets ... || true` or use set -o pipefail awareness in scripts

Example fix

// before
_, err = fmt.Fprintf(out, "%s\n", data)
if err != nil {
	return fmt.Errorf("writing output: %v", err)
}
// after
_, err = fmt.Fprintf(out, "%s\n", data)
if err != nil {
	if errors.Is(err, syscall.EPIPE) {
		return nil // consumer closed the pipe; not a real failure
	}
	return fmt.Errorf("writing output: %v", err)
}

# ensure output target is writable before running
out=/path/to/out.txt; [ -w "$(dirname "$out")" ] || { echo "unwritable output dir"; exit 1; }

if err := runGetSecrets(opts); err != nil {
	var werr error
	if strings.HasPrefix(err.Error(), "writing output:") && strings.Contains(err.Error(), "broken pipe") {
		// tolerate EPIPE from early-closing consumers
		return nil
	}
	return err
}

When it happens

Trigger: Running `kops get secrets <name> -o text` where the underlying writer `out` (stdout piped to a closed process such as `| head`, or a file with a full disk / permission problem) returns an error from Fprintf.

Common situations: Piping output into `head` or `less` which closes the pipe early (EPIPE); redirecting to a file on a full disk; running in an environment where stdout is closed.

Related errors

• error writing to output: %v
• error writing to output: %v
• error writing to output: %v
• error writing cluster json to stdout: %v
• reading Cilium IPSec config from stdin: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0de75a8189b7a70a. Report an issue: GitHub.