{"record":{"id":"a0a5ba221969e9c5","repo":"kubernetes/kops","slug":"error-reading-etcd-manifest-s-v","errorCode":null,"errorMessage":"error reading etcd manifest %s: %v","messagePattern":"error reading etcd manifest (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/manifests.go","lineNumber":49,"sourceCode":"\t*NodeupModelContext\n}\n\nvar _ fi.NodeupModelBuilder = &ManifestsBuilder{}\n\n// Build creates tasks for copying the manifests\nfunc (b *ManifestsBuilder) Build(c *fi.NodeupModelBuilderContext) error {\n\tctx := c.Context()\n\n\t// Write etcd manifests (currently etcd <=> master)\n\tif b.IsMaster {\n\t\tfor _, manifest := range b.NodeupConfig.EtcdManifests {\n\t\t\tp, err := vfs.Context.BuildVfsPath(manifest)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error parsing path for etcd manifest %s: %v\", manifest, err)\n\t\t\t}\n\t\t\tdata, err := p.ReadFile(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error reading etcd manifest %s: %v\", manifest, err)\n\t\t\t}\n\n\t\t\tname := p.Base()\n\t\t\tname = strings.TrimSuffix(name, filepath.Ext(name))\n\n\t\t\tkey := \"etcd-\" + name\n\n\t\t\tmanifestPath := \"/etc/kubernetes/manifests/\" + key + \".manifest\"\n\n\t\t\tc.AddTask(&nodetasks.File{\n\t\t\t\tContents: fi.NewBytesResource(data),\n\t\t\t\tMode:     s(\"0440\"),\n\t\t\t\tPath:     manifestPath,\n\t\t\t\tType:     nodetasks.FileType_File,\n\t\t\t})\n\t\t}\n\t}\n","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/manifests.go#L31-L67","documentation":"After resolving the VFS path, Build reads the etcd manifest contents via p.ReadFile(ctx); any storage-level failure (missing object, bad credentials, network error to S3/GCS) is wrapped in this error with the manifest name. The manifest content is required to write the etcd task on the master.","triggerScenarios":"p.ReadFile(ctx) fails during nodeup Build on a master — the etcd manifest object was deleted/moved in the storage bucket, nodeup's IAM credentials lack s3:GetObject/gcs access, or the bucket/region is unreachable.","commonSituations":"State store bucket emptied or lifecycle-policy-deleted manifests; IAM role missing read permission; wrong region/network outage from the instance; VPC without S3 endpoint.","solutions":["Verify the manifest object still exists at the URL in EtcdManifests","Check the instance's IAM role has read access to the state-store bucket/object","Test bucket reachability from the instance (aws s3 cp / gsutil cp) and check VPC endpoints/DNS","Re-run kops update cluster --yes to republish manifests, then restart nodeup"],"exampleFix":"// before: instance profile lacks S3 read\n// after: attach policy\n{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::my-cluster-bucket/*\"]}","handlingStrategy":"retry","validationCode":"// before running nodeup, from the node:\n// aws s3 cp s3://bucket/etcd.yaml -   (or gsutil cp)\n// and check the instance role:\n// aws sts get-caller-identity","typeGuard":null,"tryCatchPattern":"data, err := p.ReadFile(ctx)\nif err != nil {\n    if isRetryable(err) { // network/timeout\n        time.Sleep(5 * time.Second)\n        data, err = p.ReadFile(ctx)\n    }\n    if err != nil {\n        return fmt.Errorf(\"error reading etcd manifest %s: %v\", manifest, err)\n    }\n}","preventionTips":["Prevent bucket lifecycle rules from deleting cluster state objects","Grant the node instance role s3:GetObject on the state store","Ensure VPC S3 endpoints and DNS are configured in private subnets"],"tags":["nodeup","etcd","vfs","s3","manifest"],"backgroundTag":"manifest-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}