yaml output format is not (currently) supported for secrets

Error message

yaml output format is not (currently) supported for secrets

What it means

The secrets command supports table, plaintext output (and legacy JSON errors similarly); YAML serialization of secrets was never implemented. Requesting `-o yaml` on `kops get secrets` returns this explicit not-supported error.

Source

Thrown at cmd/kops/get_secrets.go:145

	items, err := listSecrets(secretStore, options.SecretNames)
	if err != nil {
		return err
	}

	if len(items) == 0 {
		return fmt.Errorf("no secrets found")
	}
	switch options.Output {

	case OutputTable:
		t := &tables.Table{}
		t.AddColumn("NAME", func(i string) string {
			return i
		})
		return t.Render(items, out, "NAME")

	case OutputYaml:
		return fmt.Errorf("yaml output format is not (currently) supported for secrets")
	case OutputJSON:
		return fmt.Errorf("json output format is not (currently) supported for secrets")
	case "plaintext":
		for _, item := range items {
			var data string
			secret, err := secretStore.FindSecret(item)
			if err != nil {
				return fmt.Errorf("getting secret %q: %v", item, err)
			}
			if secret == nil {
				return fmt.Errorf("cannot find secret %q", item)
			}
			data = string(secret.Data)

			_, err = fmt.Fprintf(out, "%s\n", data)
			if err != nil {
				return fmt.Errorf("writing output: %v", err)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

Use `-o plaintext` to dump secret values
Use the default table output for a name listing
If machine-readable output is needed, parse the plaintext output or use the kops API/clientset directly

Example fix

// before
kops get secrets -o yaml

// after
kops get secrets -o plaintext

Defensive patterns

Strategy: validation

Validate before calling

if [ "$OUTPUT" = "yaml" ]; then
  echo "yaml output not supported for secrets"; OUTPUT=plaintext; fi

Prevention

Use plaintext or default table output for secrets
Do not assume -o yaml works uniformly across all kops get subcommands

When it happens

Trigger: Running `kops get secrets -o yaml` (or --output yaml).

Common situations: Users applying the standard kops `-o yaml` habit from other get commands; scripts that uniformly parse all get output as YAML.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ba6f79534f0d9598. Report an issue: GitHub.