GoogleContainerTools/skaffold · error

failed to copy rendered manifests to GCS: %w

Error message

failed to copy rendered manifests to GCS: %w

What it means

After staging rendered manifests in a temp file, Write uploads them to the gs:// destination via client.Native{}.UploadFile. Any GCS API failure (auth, bucket missing, permissions, network) is wrapped by writeErr as 'failed to copy rendered manifests to GCS'.

Source

Thrown at pkg/skaffold/kubernetes/manifest/util.go:56

// Write writes manifests to a file, a writer or a GCS bucket.
func Write(manifests string, output string, manifestOut io.Writer) error {
	switch {
	case output == "":
		_, err := fmt.Fprintln(manifestOut, manifests)
		return err
	case strings.HasPrefix(output, gcsPrefix):
		tempDir, err := os.MkdirTemp("", manifestsStagingFolder)
		if err != nil {
			return writeErr(fmt.Errorf("failed to create the tmp directory: %w", err))
		}
		defer os.RemoveAll(tempDir)
		tempFile := filepath.Join(tempDir, renderedManifestsStagingFile)
		if err := dumpToFile(manifests, tempFile); err != nil {
			return err
		}
		gcs := client.Native{}
		if err := gcs.UploadFile(context.Background(), tempFile, output); err != nil {
			return writeErr(fmt.Errorf("failed to copy rendered manifests to GCS: %w", err))
		}
		return nil
	default:
		return dumpToFile(manifests, output)
	}
}

func dumpToFile(manifests string, filepath string) error {
	f, err := os.Create(filepath)
	if err != nil {
		return fmt.Errorf("opening file for writing manifests: %w", err)
	}
	defer f.Close()
	_, err = f.WriteString(manifests + "\n")
	return err
}

View on GitHub (pinned to a1189de023)

Solutions

1. Authenticate: run `gcloud auth application-default login` (local) or attach a service account with Storage Object Admin to CI
2. Verify the bucket exists and the output gs:// path is correct (`gsutil ls` on the bucket)
3. Grant storage.objects.create permission on the bucket to the acting identity, then retry

creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/devstorage.read_write")
if err != nil {
    return fmt.Errorf("no GCS credentials: %w", err)
}
// and verify bucket access:
_, err = storageClient.Bucket(bucket).Attrs(ctx)

if err != nil {
    var gErr *googleapi.Error
    if errors.As(err, &gErr) {
        switch gErr.Code {
        case 401, 403: // re-authenticate / fix IAM
        case 404:     // check bucket name
        }
    }
    return err
}

When it happens

Trigger: Calling Write with output='gs://bucket/path' when UploadFile fails: unauthenticated gcloud session, nonexistent bucket, lacking storage.objects.create permission, or network error.

Common situations: CI without Application Default Credentials; typo in bucket name; service account missing roles/storage.objectAdmin on the bucket; private buckets from a different project.

Related errors

• error creating GCS Client: %w
• failed to cache Google Cloud Storage objects from %q: %w
• failed to copy valuesFile from GCS: %w
• failed to create the tmp directory: %w
• downloading from GCS: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/99a980f2db5cf68c. Report an issue: GitHub.