{"record":{"id":"7a468d1c16c141b3","repo":"kubernetes/kops","slug":"error-building-discoverystore-for-cluster-v","errorCode":null,"errorMessage":"error building DiscoveryStore for cluster: %v","messagePattern":"error building DiscoveryStore for cluster: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":402,"sourceCode":"\t\tcluster.Spec.CloudProvider.Scaleway = &api.ScalewaySpec{}\n\tcase api.CloudProviderLinode:\n\t\tcluster.Spec.CloudProvider.Linode = &api.LinodeSpec{}\n\tcase api.CloudProviderMetal:\n\t\tif !featureflag.Metal.Enabled() {\n\t\t\treturn nil, fmt.Errorf(\"bare-metal support requires the Metal feature flag to be enabled\")\n\t\t}\n\t\tif cluster.Labels == nil {\n\t\t\tcluster.Labels = make(map[string]string)\n\t\t}\n\t\tcluster.Labels[api.AlphaLabelCloudProvider] = string(api.CloudProviderMetal)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported cloud provider %s\", opt.CloudProvider)\n\t}\n\n\tif opt.DiscoveryStore != \"\" {\n\t\tdiscoveryPath, err := clientset.VFSContext().BuildVfsPath(opt.DiscoveryStore)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error building DiscoveryStore for cluster: %v\", err)\n\t\t}\n\t\tcluster.Spec.ServiceAccountIssuerDiscovery = &api.ServiceAccountIssuerDiscoveryConfig{\n\t\t\tDiscoveryStore: discoveryPath.Join(cluster.Name).Path(),\n\t\t}\n\t\tif cluster.GetCloudProvider() == api.CloudProviderAWS {\n\t\t\tcluster.Spec.ServiceAccountIssuerDiscovery.EnableAWSOIDCProvider = true\n\t\t\tcluster.Spec.IAM.UseServiceAccountExternalPermissions = new(true)\n\t\t}\n\t}\n\n\terr = setupVPC(opt, cluster, cloud)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tzoneToSubnetsMap, err := setupZones(opt, cluster, allZones)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L384-L420","documentation":"When --discovery-store is set, NewCluster builds a VFS path via clientset.VFSContext().BuildVfsPath to hold service-account issuer discovery documents. A malformed or unsupported store path returns this wrapped error.","triggerScenarios":"`kops create cluster --discovery-store <path>` where path uses an unknown scheme, is malformed (e.g. \"s3:/bucket\" single slash), or points to a backend VFS cannot construct (plus underlying backend errors).","commonSituations":"Typo in the s3:// or gs:// URI; using a local path where a vfs scheme is required; required for karpenter (--instance-manager karpenter) so it's commonly hit when wiring OIDC discovery.","solutions":["Correct the --discovery-store URI, e.g. --discovery-store s3://my-bucket/discovery","Verify the scheme is one supported by kOps VFS (s3, gs, vfs, file, etc.)","Read the wrapped %v error for the exact BuildVfsPath failure"],"exampleFix":"// before\nkops create cluster --discovery-store s3-discovery-bucket --name c.example.com\n// after\nkops create cluster --discovery-store s3://discovery-bucket --name c.example.com","handlingStrategy":"validation","validationCode":"if opt.DiscoveryStore != \"\" {\n    if _, err := clientset.VFSContext().BuildVfsPath(opt.DiscoveryStore); err != nil {\n        return fmt.Errorf(\"invalid --discovery-store: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"_, err := NewCluster(opt, cs)\nif err != nil && strings.Contains(err.Error(), \"error building DiscoveryStore\") {\n    // fix the --discovery-store URI scheme/path and retry\n}","preventionTips":["Use a fully qualified scheme, e.g. s3://bucket/prefix","Mirror the syntax of --state which uses the same VFS layer","Test the bucket path exists before create cluster"],"tags":["discovery-store","vfs","oidc"],"backgroundTag":"invalid-state-store","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}