GoogleContainerTools/skaffold · error

downloading from GCS: %w

Error message

downloading from GCS: %w

What it means

Skaffold's render generator wraps any failure from manifest.DownloadFromGCS with this message. DownloadFromGCS fetches Kubernetes manifests stored in Google Cloud Storage buckets into a temporary directory so they can be rendered locally. The wrap means a GCS download (auth, network, object-not-found) failed while resolving the rawK8s manifest list in resolveRemoteAndLocal.

Source

Thrown at pkg/skaffold/render/generate/generate.go:99

			gcsManifests = append(gcsManifests, path)
		default:
			// expand paths
			path, err := util.ExpandEnvTemplate(path, nil)
			if err != nil {
				return nil, err
			}
			localPaths = append(localPaths, path)
		}
	}
	list, err := util.ExpandPathsGlob(workdir, localPaths)
	if err != nil {
		return nil, err
	}
	if len(gcsManifests) != 0 {
		// return tmp dir of the downloaded manifests
		tmpDir, err := manifest.DownloadFromGCS(gcsManifests)
		if err != nil {
			return nil, fmt.Errorf("downloading from GCS: %w", err)
		}
		l, err := util.ExpandPathsGlob(tmpDir, []string{"*"})
		if err != nil {
			return nil, fmt.Errorf("expanding kubectl manifest paths: %w", err)
		}
		list = append(list, l...)
	}
	if len(urlManifests) != 0 {
		paths, err := manifest.DownloadFromURL(urlManifests)
		if err != nil {
			return nil, err
		}
		list = append(list, paths...)
	}
	return list, nil
}

// Generate parses the config resources from the paths in .Generate.Manifests. This path can be the path to raw manifest,

View on GitHub (pinned to a1189de023)

Solutions

1. Verify the gs:// paths in rawK8s exist: gsutil ls gs://<bucket>/<path>
2. Authenticate: run gcloud auth application-default login (or configure the CI service account with Storage Object Viewer)
3. Test network access to storage.googleapis.com (proxy/firewall may block it)
4. As a fallback, download the manifests manually and reference local paths in rawK8s

Example fix

// before: unauthenticated CI can't reach GCS
rawK8s:
  - gs://my-bucket/manifests/*.yaml
// after: pre-fetch with auth or use local paths
rawK8s:
  - ./manifests/*.yaml

gsutil ls gs://my-bucket/manifests/ >/dev/null 2>&1 || echo 'GCS path missing or unauthorized'

manifests, err := gen.Generate(ctx, out)
if err != nil && strings.Contains(err.Error(), "downloading from GCS") {
    // check gcloud auth: gcloud auth application-default login
    // verify gs:// paths and network, then retry
}

When it happens

Trigger: A skaffold.yaml render.generate.rawK8s entry with a gs:// URL, causing resolveRemoteAndLocal to call manifest.DownloadFromGCS, which returns an error (network failure, missing object, insufficient GCS permissions).

Common situations: gs:// object path typo or deleted bucket; no gcloud credentials / Application Default Credentials available (CI without auth); firewall blocking storage.googleapis.com; service account lacking storage.objects.get.

Related errors

• failed to cache Google Cloud Storage objects from %q: %w
• error creating GCS Client: %w
• failed to iterate objects: %v
• failed to read object: %v
• failed to copy object to file: %v

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/627a33672e0a1f64. Report an issue: GitHub.