{"record":{"id":"0bf368af91f143bb","repo":"kubernetes/kops","slug":"the-q-path-does-not-support-public-acl","errorCode":null,"errorMessage":"the %q path does not support public ACL","messagePattern":"the %q path does not support public ACL","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/managedfile.go","lineNumber":147,"sourceCode":"\tctx := c.Context()\n\n\tpublicRead := s3types.ObjectCannedACLPublicRead\n\tvar acl vfs.ACL\n\tif fi.ValueOf(e.PublicACL) {\n\t\tswitch p := p.(type) {\n\t\tcase *vfs.S3Path:\n\t\t\tacl = &vfs.S3Acl{\n\t\t\t\tRequestACL: &publicRead,\n\t\t\t}\n\t\tcase *vfs.MemFSPath:\n\t\t\tif !p.IsClusterReadable() {\n\t\t\t\treturn nil, fmt.Errorf(\"the %q path is intended for use in tests\", p.Path())\n\t\t\t}\n\t\t\tacl = &vfs.S3Acl{\n\t\t\t\tRequestACL: &publicRead,\n\t\t\t}\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"the %q path does not support public ACL\", p.Path())\n\t\t}\n\t\treturn acl, nil\n\t}\n\n\treturn acls.GetACL(ctx, p, c.T.Cluster)\n}\n\nfunc (_ *ManagedFile) Render(c *fi.CloudupContext, a, e, changes *ManagedFile) error {\n\tctx := c.Context()\n\n\tlocation := fi.ValueOf(e.Location)\n\tif location == \"\" {\n\t\treturn fi.RequiredField(\"Location\")\n\t}\n\n\tdata, err := fi.ResourceAsBytes(e.Contents)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error reading contents of ManagedFile: %v\", err)","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/managedfile.go#L129-L165","documentation":"getACL switches on the concrete vfs.Path type to build an ACL for public ManagedFiles. If the path type is not S3Path or MemFSPath, there is no public-ACL implementation, so it fails with this error listing the path.","triggerScenarios":"Render or RenderTerraform of a ManagedFile with public access whose base path resolves to a VFS type without public ACL support (e.g. gs://, file paths, or other non-S3 backends).","commonSituations":"Using a GCS or other cloud state store while the ManagedFile is configured to be publicly readable — public ACL logic is S3-specific.","solutions":["Store the ManagedFile on an S3-backed path, or make the file non-public so the generic acls.GetACL path is used instead.","Check the ManagedFile public flag in the cluster spec; set it false when not using S3.","If GCS support is needed, extend getACL with the corresponding ACL type upstream."],"exampleFix":"// before: public managedfile on GCS\nbase: \"gs://my-bucket/cluster\"\n// after: move to S3 or disable public ACL\nbase: \"s3://my-bucket/cluster\"","handlingStrategy":"type-guard","validationCode":"p, err := vfs.Context.BuildVfsPath(base)\nif err != nil { return err }\nif _, ok := p.(*vfs.S3Path); !ok && publicAccessRequired {\n    return fmt.Errorf(\"public ACL requires S3 path, got %T\", p)\n}","typeGuard":"_, ok := p.(*vfs.S3Path); return ok","tryCatchPattern":"if err != nil { return fmt.Errorf(\"getACL failed for %s: %w\", p.Path(), err) }","preventionTips":["Only mark ManagedFiles public when stored on S3","For GCS or other backends leave public disabled","Check the Base scheme before enabling public ACLs"],"tags":["vfs","acl","s3"],"backgroundTag":"unsupported-path-public-acl","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}