{"record":{"id":"820fc938f57f213c","repo":"kubernetes/kops","slug":"featureflag-googlecloudbucketacl-not-supported-wit","errorCode":null,"errorMessage":"featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount","messagePattern":"featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/gcemodel/storageacl.go","lineNumber":48,"sourceCode":"\t\"k8s.io/kops/upup/pkg/fi/cloudup/gcetasks\"\n\t\"k8s.io/kops/util/pkg/vfs\"\n)\n\n// StorageAclBuilder configures storage acls\ntype StorageAclBuilder struct {\n\t*GCEModelContext\n\tCloud     gce.GCECloud\n\tLifecycle fi.Lifecycle\n}\n\nvar _ fi.CloudupModelBuilder = &StorageAclBuilder{}\n\n// Build creates the tasks that set up storage acls\n\nfunc (b *StorageAclBuilder) Build(c *fi.CloudupModelBuilderContext) error {\n\tif featureflag.GoogleCloudBucketACL.Enabled() {\n\t\tif b.Cluster.Spec.CloudProvider.GCE.ServiceAccount == \"\" {\n\t\t\treturn fmt.Errorf(\"featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount\")\n\t\t}\n\n\t\tklog.Warningf(\"featureflag GoogleCloudBucketACL is no longer recommended; use per-instancegroup GCEServiceAccounts instead\")\n\n\t\tgceDefaultServiceAccount, err := b.Cloud.ServiceAccount()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error fetching default ServiceAccount: %w\", err)\n\t\t}\n\n\t\tclusterPath := b.Cluster.Spec.ConfigStore.Base\n\t\tp, err := vfs.Context.BuildVfsPath(clusterPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot parse cluster path %q: %w\", clusterPath, err)\n\t\t}\n\n\t\tif p, ok := p.(*vfs.GSPath); ok {\n\t\t\t// It's not ideal that we have to do this at the bucket level,\n\t\t\t// but GCS doesn't seem to have a way to do subtrees (like AWS IAM does)","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/gcemodel/storageacl.go#L30-L66","documentation":"A configuration-compatibility guard: the legacy GoogleCloudBucketACL feature flag is enabled while the cluster has no cluster-level GCE service account (i.e. uses per-instancegroup accounts); the ACL mechanism requires the cluster-level account, so the build is halted rather than producing broken ACLs.","triggerScenarios":"Thrown at pkg/model/gcemodel/storageacl.go:48 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Disable the GoogleCloudBucketACL feature flag (deprecated) and rely on per-IG service-account IAM bindings","Or set a cluster-level cloudProvider.gce.serviceAccount","Re-run kops update"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}