{"record":{"id":"7368810a37462e55","repo":"kubernetes/kops","slug":"the-q-path-is-intended-for-use-in-tests","errorCode":null,"errorMessage":"the %q path is intended for use in tests","messagePattern":"the %q path is intended for use in tests","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/fitasks/managedfile.go","lineNumber":141,"sourceCode":"\t\treturn field.Required(field.NewPath(\"Contents\"), \"\")\n\t}\n\treturn nil\n}\n\nfunc (e *ManagedFile) getACL(c *fi.CloudupContext, p vfs.Path) (vfs.ACL, error) {\n\tctx := c.Context()\n\n\tpublicRead := s3types.ObjectCannedACLPublicRead\n\tvar acl vfs.ACL\n\tif fi.ValueOf(e.PublicACL) {\n\t\tswitch p := p.(type) {\n\t\tcase *vfs.S3Path:\n\t\t\tacl = &vfs.S3Acl{\n\t\t\t\tRequestACL: &publicRead,\n\t\t\t}\n\t\tcase *vfs.MemFSPath:\n\t\t\tif !p.IsClusterReadable() {\n\t\t\t\treturn nil, fmt.Errorf(\"the %q path is intended for use in tests\", p.Path())\n\t\t\t}\n\t\t\tacl = &vfs.S3Acl{\n\t\t\t\tRequestACL: &publicRead,\n\t\t\t}\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"the %q path does not support public ACL\", p.Path())\n\t\t}\n\t\treturn acl, nil\n\t}\n\n\treturn acls.GetACL(ctx, p, c.T.Cluster)\n}\n\nfunc (_ *ManagedFile) Render(c *fi.CloudupContext, a, e, changes *ManagedFile) error {\n\tctx := c.Context()\n\n\tlocation := fi.ValueOf(e.Location)\n\tif location == \"\" {","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/fitasks/managedfile.go#L123-L159","documentation":"ManagedFile's getACL determines an ACL when publishing a file with public (public-read) access. For a MemFS path (in-memory filesystem), public ACL is only meaningful for cluster-readable test paths; any other MemFS path is rejected because MemFS is meant for tests only.","triggerScenarios":"getACL (called by Render/RenderTerraform) is given a vfs.MemFSPath that is not cluster-readable — i.e. requesting public ACL on an in-memory path outside a test scenario.","commonSituations":"Running kops against a test/in-memory state store while the ManagedFile requires a public ACL; misconfigured base path pointing to memfs:// in a real cluster apply.","solutions":["Use a real VFS backend (e.g. s3:// state store) for the ManagedFile Base instead of memfs://.","If this is genuinely a test, ensure the MemFSPath is created cluster-readable.","Remove the requirement for public ACL on the file if it should stay private."],"exampleFix":"// before\nbase: \"memfs://tests\"\n// after\nbase: \"s3://my-kops-state-store/cluster.example.com\"","handlingStrategy":"type-guard","validationCode":"p, err := vfs.Context.BuildVfsPath(base)\nif err != nil { return err }\nif _, ok := p.(*vfs.MemFSPath); ok && !p.IsClusterReadable() {\n    return fmt.Errorf(\"memfs path %q not valid outside tests\", p.Path())\n}","typeGuard":"if mp, ok := p.(*vfs.MemFSPath); ok { return mp.IsClusterReadable() }\nreturn true","tryCatchPattern":"if err != nil { return fmt.Errorf(\"public ACL unsupported for %s: %w\", p.Path(), err) }","preventionTips":["Use memfs:// only in unit tests","Use a real cloud VFS backend for production applies","Ensure test MemFS paths are created cluster-readable"],"tags":["vfs","acl","s3"],"backgroundTag":"unsupported-path-public-acl","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}