GoogleContainerTools/skaffold · error

failed to copy valuesFile from GCS: %w

Error message

failed to copy valuesFile from GCS: %w

What it means

Skaffold's Helm deployer downloads a values file when a helm values entry is a gs:// URI instead of a local path. extractValueFileFromGCS calls gcs.Gsutil.Copy to fetch the object into a temp dir; if that copy fails it wraps the underlying error with this message. It means the values file could not be retrieved from Google Cloud Storage before helm args were constructed.

Source

Thrown at pkg/skaffold/helm/args.go:188

		customMap["DIGEST_HEX"] = names[1]
	} else {
		customMap["DIGEST_HEX"] = digest
	}

	// IMAGE_DOMAIN and IMAGE_REPO_NO_DOMAIN added for v2beta* 'helm+explicitRegistry' -> v3alpha* and beyond compatibility
	customMap["IMAGE_DOMAIN"] = ref.Domain
	customMap["IMAGE_REPO_NO_DOMAIN"] = strings.TrimPrefix(ref.BaseName, ref.Domain+"/")
	customMap["IMAGE_FULLY_QUALIFIED"] = digest
	return customMap
}

// Copy the value file from the GCS bucket if it starts with gs://
func extractValueFileFromGCS(v, tempDir string, gcs gcs.Gsutil) (string, error) {
	// get a filename from gcs
	tempValueFile := filepath.Join(tempDir, path.Base(v))

	if err := gcs.Copy(context.TODO(), v, tempValueFile, false); err != nil {
		return "", fmt.Errorf("failed to copy valuesFile from GCS: %w", err)
	}

	return tempValueFile, nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Verify the gs:// URI exists: `gsutil ls <uri>` (fix typos in bucket/object path)
2. Authenticate: `gcloud auth application-default login` (local) or grant the CI service account storage.objectViewer
3. Install/verify the Google Cloud SDK (gsutil) is on PATH
4. Check network/firewall access to storage.googleapis.com
5. If the file is local, remove the gs:// prefix and use a relative or absolute local path

Example fix

// before
valuesFiles:
  - gs://my-bucket/config/prod-values.yaml
// after
valuesFiles:
  - ./charts/values/prod-values.yaml

// before skaffold deploy
gsutil ls gs://my-bucket/config/prod-values.yaml || echo "GCS object missing or no access"

When it happens

Trigger: A values.yaml path in helm releases config starts with gs:// and gcs.Copy fails: the GCS object doesn't exist, the bucket/project lacks permission (no Cloud Storage scope or no authenticated account), gsutil/cloud SDK is not installed, network is down, or the URI is malformed.

Common situations: CI service account missing roles/storage.objectViewer on the bucket; running locally without `gcloud auth application-default login`; typo in bucket name or object path; firewall blocking storage.googleapis.com; using a gs:// path where a local file was intended.

Related errors

• failed to iterate objects: %v
• failed to read object: %v
• failed to copy object to file: %v
• error copying file to GCS: %w
• error closing GCS writer: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/5301033a868bbca2. Report an issue: GitHub.