{"record":{"id":"a126f5ccc00a3fb8","repo":"kubernetes/kops","slug":"error-building-acl-for-secret-q-for-mirror-v","errorCode":null,"errorMessage":"error building acl for secret %q for mirror: %v","messagePattern":"error building acl for secret %q for mirror: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/secrets/vfs_secretstore.go","lineNumber":76,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"error listing secrets for mirror: %v\", err)\n\t}\n\n\tfor _, name := range secrets {\n\t\tsecret, err := c.FindSecret(name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading secret %q for mirror: %v\", name, err)\n\t\t}\n\n\t\tif secret == nil {\n\t\t\treturn fmt.Errorf(\"unable to find secret %q for mirror\", name)\n\t\t}\n\n\t\tp := BuildVfsSecretPath(basedir, name)\n\n\t\tacl, err := acls.GetACL(ctx, p, c.cluster)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error building acl for secret %q for mirror: %v\", name, err)\n\t\t}\n\n\t\tklog.Infof(\"mirroring secret %s -> %s\", name, p)\n\n\t\terr = createSecret(ctx, secret, p, acl, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error writing secret %q for mirror: %v\", name, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// DeleteSecret implements fi.SecretStore DeleteSecret\nfunc (c *VFSSecretStore) DeleteSecret(name string) error {\n\tctx := context.TODO()\n\n\tp := c.buildSecretPath(name)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/secrets/vfs_secretstore.go#L58-L94","documentation":"Before writing each mirrored secret, MirrorTo computes the destination ACL with acls.GetACL(ctx, p, c.cluster). If ACL computation fails — e.g. the cluster spec lacks the fields needed to derive permissions for the target VFS path — the error is wrapped as 'error building acl for secret %q for mirror'. The secret is not written in this case.","triggerScenarios":"GetACL cannot determine permissions for the destination path: cluster field missing/invalid in the kops.Cluster object, unsupported VFS path scheme for ACL derivation, or an error fetching cloud identity info (e.g. AWS account lookups) required to build S3 ACLs.","commonSituations":"Mirroring to a state store in a different account/region where the cluster spec has no matching config, kops version changes in ACL schema, incomplete cluster spec loaded from an old state store.","solutions":["Check the wrapped cause; fix the cluster spec field it complains about (e.g. `kops edit cluster`)","Verify the destination VFS path scheme is supported by the ACL builder","Re-run `kops update` / upgrade the cluster spec so required identity fields are present","Mirror to a path within the same state store backend where ACLs are derivable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Derive the ACL yourself before mirroring to surface spec problems early\np := secrets.BuildVfsSecretPath(target, \"probe\")\nif _, err := acls.GetACL(ctx, p, cluster); err != nil {\n    return fmt.Errorf(\"cluster spec cannot produce ACLs for target: %v\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the cluster spec complete and current (`kops update cluster` after upgrades)","Mirror only to VFS paths of the same scheme/account family as the source","Validate `kops edit cluster` changes before rotating secrets","Pin kops versions consistently between operators"],"tags":["vfs","secrets","acl","mirror"],"backgroundTag":"acl-derivation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}