{"record":{"id":"41c24cd2ccd9ba9a","repo":"kubernetes/kops","slug":"error-building-secret-store-path-v","errorCode":null,"errorMessage":"error building secret store path: %v","messagePattern":"error building secret store path: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/command.go","lineNumber":220,"sourceCode":"\t\tCloud:        cloud,\n\t\tArchitecture: architecture,\n\t\tAssets:       assetStore,\n\t\tConfigBase:   configBase,\n\t\tDistribution: distribution,\n\t\tBootConfig:   &bootConfig,\n\t\tNodeupConfig: &nodeupConfig,\n\t}\n\n\tvar secretStore fi.SecretStoreReader\n\tvar keyStore fi.KeystoreReader\n\tswitch {\n\tcase nodeConfig != nil:\n\t\tmodelContext.SecretStore = configserver.NewSecretStore(nodeConfig.NodeSecrets)\n\tcase nodeupConfig.ConfigStore != nil && nodeupConfig.ConfigStore.Secrets != \"\":\n\t\tklog.Infof(\"Building SecretStore at %q\", nodeupConfig.ConfigStore.Secrets)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building secret store path: %v\", err)\n\t\t}\n\n\t\tsecretStore = secrets.NewVFSSecretStoreReader(p)\n\t\tmodelContext.SecretStore = secretStore\n\tdefault:\n\t\treturn fmt.Errorf(\"SecretStore not set\")\n\t}\n\n\tif nodeConfig != nil {\n\t\tmodelContext.KeyStore = configserver.NewKeyStore()\n\t} else if nodeupConfig.ConfigStore.Keypairs != \"\" {\n\t\tklog.Infof(\"Building KeyStore at %q\", nodeupConfig.ConfigStore.Keypairs)\n\t\tp, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building key store path: %v\", err)\n\t\t}\n\n\t\tmodelContext.KeyStore = fi.NewVFSKeystoreReader(p)","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/command.go#L202-L238","documentation":"When running in VFS mode (no config server), nodeup builds the SecretStore from the path in nodeupConfig.ConfigStore.Secrets via vfs.Context.BuildVfsPath. This error means the secrets location string is not a valid/constructible VFS path (unknown scheme, malformed URL, unsupported backend). Run aborts before the secret store can be wired into the model context.","triggerScenarios":"Running NodeUpCommand.Run() with nodeConfig == nil and nodeupConfig.ConfigStore.Secrets set to a string BuildVfsPath cannot parse — e.g. a typo'd scheme like 's:/bucket/secrets', an unsupported protocol, or shell-mangled characters in the path.","commonSituations":"Hand-edited nodeupconfig.yaml with a malformed secrets path; migrating between state-store backends (S3/GCS/OSS) and leaving a stale or invalid URI; quoting/escaping problems introduced during templating of the config.","solutions":["Fix ConfigStore.Secrets in the cluster spec / nodeupconfig.yaml to a valid VFS path with a supported scheme (e.g. s3://bucket/cluster/secrets, gs://bucket/secrets, or a filesystem path).","Re-run 'kops update cluster --yes' so nodeupconfig.yaml is regenerated from a corrected cluster spec instead of editing the file directly.","Verify the VFS backend for the scheme is compiled in / credentials are configured (note: BuildVfsPath failure is parse-level, but bad env can accompany scheme mistakes).","If migrating backends, update all ConfigStore fields (secrets, keypairs) consistently via 'kops editor' / cluster spec rather than partial edits."],"exampleFix":"// before (nodeupconfig.yaml)\nconfigStore:\n  secrets: s:/bucket/cluster/secrets\n// after\nconfigStore:\n  secrets: s3://bucket/cluster/secrets","handlingStrategy":"validation","validationCode":"// Ensure the secrets path is a parseable VFS path before invoking nodeup\nif _, err := vfs.Context.BuildVfsPath(cfg.ConfigStore.Secrets); err != nil {\n    return fmt.Errorf(\"invalid ConfigStore.Secrets path %q: %w\", cfg.ConfigStore.Secrets, err)\n}","typeGuard":null,"tryCatchPattern":"err := cmd.Run(out)\nif err != nil && strings.Contains(err.Error(), \"error building secret store path\") {\n    // fix the scheme/URI in the cluster spec and re-apply\n}","preventionTips":["Let kOps generate ConfigStore paths via 'kops update cluster'; avoid hand-editing","Use full, correctly-schemed URIs (s3://, gs://, /abs/path) in the cluster spec","Escape/quote paths carefully in userdata templating"],"tags":["nodeup","vfs","secretstore","path-parsing"],"backgroundTag":"invalid-vfs-path","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}