{"record":{"id":"1601dfe8c753a579","repo":"kubernetes/kops","slug":"building-vfs-path-for-q-w","errorCode":null,"errorMessage":"building VFS path for %q: %w","messagePattern":"building VFS path for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/issuerdiscovery.go","lineNumber":85,"sourceCode":"\t}\n\n\tskTask := signingKeyTaskObject.(*fitasks.Keypair)\n\n\tkeys := &OIDCKeys{\n\t\tSigningKey: skTask,\n\t}\n\n\tdiscovery, err := buildDiscoveryJSON(*b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar publicFileACL *bool\n\n\tdiscoveryStorePath := b.Cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore\n\tdiscoveryStore, err := vfs.Context.BuildVfsPath(discoveryStorePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"building VFS path for %q: %w\", discoveryStorePath, err)\n\t}\n\n\tswitch discoveryStore := discoveryStore.(type) {\n\tcase *vfs.S3Path:\n\t\tdiscoveryStoreURL, err := discoveryStore.GetHTTPsUrl(b.Cluster.Spec.IsIPv6Only())\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {\n\t\t\t// Using Amazon S3 static website hosting requires public access\n\t\t\tisPublic, err := discoveryStore.IsBucketPublic(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"checking if bucket was public: %w\", err)\n\t\t\t}\n\t\t\tif !isPublic {\n\t\t\t\tklog.Infof(\"serviceAccountIssuers bucket %q is not public; will use object ACL\", discoveryStore.Bucket())\n\t\t\t\tpublicFileACL = new(true)\n\t\t\t}","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/issuerdiscovery.go#L67-L103","documentation":"vfs.Context.BuildVfsPath parses the discoveryStore URI from cluster.spec.serviceAccountIssuerDiscovery.discoveryStore into a concrete VFS path (e.g. s3://, gs://, memfs://). This error wraps any parse/credential/registry failure, meaning the store path string is malformed or no VFS path implementation is registered for its scheme.","triggerScenarios":"`kops update cluster` with an unparseable discoveryStore value such as a relative path, a URL with an unsupported scheme (e.g. azureblob://, file:// without VFS support), or a syntactically invalid URI.","commonSituations":"Typos in the discoveryStore setting (missing scheme, stray spaces), copying a store path from another cloud provider (GS path on an AWS cluster context without gs support compiled in), or using a scheme kops' VFS registry does not handle.","solutions":["Fix the discoveryStore value to a supported scheme: s3://bucket/prefix (AWS) or gs://bucket/prefix (GCP).","Verify for typos/whitespace: `kops get cluster -o yaml | grep discoveryStore`.","Confirm cloud provider matches the scheme (S3 path for AWS clusters, GS path for GCP clusters).","If the scheme is correct but credentials/cloud SDK are missing, fix the environment so the VFS client can be constructed."],"exampleFix":"// before\nspec:\n  serviceAccountIssuerDiscovery:\n    discoveryStore: s3/oidc-bucket\n// after\nspec:\n  serviceAccountIssuerDiscovery:\n    discoveryStore: s3://oidc-bucket/cluster.example.com","handlingStrategy":"validation","validationCode":"// Validate discoveryStore before applying the cluster:\nstore := cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore\nu, err := url.Parse(store)\nif err != nil || u.Scheme == \"\" {\n    return fmt.Errorf(\"discoveryStore %q must be a URI with scheme s3:// or gs://\", store)\n}\nif u.Scheme != \"s3\" && u.Scheme != \"gs\" {\n    return fmt.Errorf(\"unsupported discoveryStore scheme %q; use s3:// or gs://\", u.Scheme)\n}","typeGuard":null,"tryCatchPattern":"if err := runUpdate(); err != nil {\n    if strings.Contains(err.Error(), \"building VFS path for\") {\n        log.Printf(\"check serviceAccountIssuerDiscovery.discoveryStore URI: %v\", err)\n    }\n}","preventionTips":["Always use fully-qualified s3:// or gs:// URIs with bucket and prefix.","Lint the cluster spec with `kops toolbox template` or a schema check before `kops update`.","Match the scheme to the cluster's cloud provider (S3 for AWS, GS for GCP).","Avoid hand-editing YAML; use `kops edit cluster` and verify with `kops get -o yaml`."],"tags":["kops","vfs","configuration","s3","gcs"],"backgroundTag":"invalid-vfs-path","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}