{"record":{"id":"b3642e523237fac5","repo":"kubernetes/kops","slug":"path-is-not-cluster-readable-v","errorCode":null,"errorMessage":"path is not cluster readable: %v","messagePattern":"path is not cluster readable: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":626,"sourceCode":"\t\t\t\treturn err\n\t\t\t}\n\n\t\tcase *vfs.MemFSPath:\n\t\t\t// Tests - we emulate the s3 permissions so that we can get an idea of the full policy\n\n\t\t\tiamS3Path := \"placeholder-read-bucket/\" + path.Location()\n\t\t\tb.buildS3GetStatements(p, iamS3Path)\n\t\t\ts3Buckets.Insert(\"placeholder-read-bucket\")\n\t\tcase *vfs.FSPath:\n\t\t\t// tests - we emulate the s3 permissions so that we can get an idea of the full policy\n\n\t\t\tiamS3path := \"placeholder-read-bucket/\" + strings.TrimPrefix(path.Path(), \"file://\")\n\t\t\tb.buildS3GetStatements(p, iamS3path)\n\t\t\ts3Buckets.Insert(\"placeholder-read-bucket\")\n\t\tdefault:\n\t\t\t// We could implement this approach, but it seems better to\n\t\t\t// get all clouds using cluster-readable storage\n\t\t\treturn fmt.Errorf(\"path is not cluster readable: %v\", root)\n\t\t}\n\t}\n\n\twriteablePaths, err := WriteableVFSPaths(b.Cluster, b.Role)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, vfsPath := range writeablePaths {\n\t\tswitch path := vfsPath.(type) {\n\t\tcase *vfs.S3Path:\n\t\t\tiamS3Path := path.Bucket() + \"/\" + path.Key()\n\t\t\tiamS3Path = strings.TrimSuffix(iamS3Path, \"/\")\n\n\t\t\tb.buildS3WriteStatements(p, iamS3Path)\n\t\t\ts3Buckets.Insert(path.Bucket())\n\t\tcase *vfs.MemFSPath:\n\t\t\tiamS3Path := \"placeholder-write-bucket/\" + path.Location()","sourceCodeStart":608,"sourceCodeEnd":644,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L608-L644","documentation":"AddS3Permissions only knows how to grant S3 IAM permissions for S3Path, MemFSPath (tests) and FSPath (tests). When a state-store root resolves to any other vfs.Path implementation, kOps refuses rather than emit wrong permissions, returning 'path is not cluster readable'. The comment in source says all clouds should use cluster-readable storage instead of this fallback.","triggerScenarios":"Building AWS IAM policies while the cluster state store root resolves to a non-S3, non-test filesystem VFS type — e.g. a gs:// (GCS), azure://, or swift:// path passed into AWS policy generation, or any newly added VFS backend lacking a case in the switch.","commonSituations":"Migrating a cluster between clouds and reusing a GCS/Azure state store with AWS IAM building; CI harness using an unexpected VFS implementation; kOps version where a backend type was added but IAM builder support is missing.","solutions":["Confirm you are building AWS IAM policies against an s3:// state store; switch --state to an S3 bucket if you pointed at another cloud's store.","If you truly need non-S3 storage, this is unsupported for AWS IAM synthesis — create an S3 state store and `kops replace`/migrate the cluster config.","Check the kOps version for backend support; upgrade if a newer release added cluster-readable support for your storage type.","For tests, use vfs.MemFSPath or a file:// FSPath which are emulated as placeholder buckets."],"exampleFix":"// before: AWS cluster built against GCS state store\n--state gs://my-kops-bucket/clusters/example.k8s.local\n// after\n--state s3://my-kops-bucket/clusters/example.k8s.local","handlingStrategy":"validation","validationCode":"// Resolve the store first and require an S3-backed path\nvfsPath, err := vfs.Context.BuildVfsPath(stateStore)\nif err != nil { return err }\nif _, ok := vfsPath.(*vfs.S3Path); !ok {\n    return fmt.Errorf(\"state store %q is not cluster-readable S3 storage\", stateStore)\n}","typeGuard":"func isS3Path(p vfs.Path) bool { _, ok := p.(*vfs.S3Path); return ok }","tryCatchPattern":"if err := builder.AddS3Permissions(policy); err != nil {\n    if strings.Contains(err.Error(), \"not cluster readable\") {\n        // switch to an s3:// state store and retry\n    }\n    return err\n}","preventionTips":["Use S3 state stores for all AWS kOps clusters","After cloud migration, recreate/migrate the state store to the target cloud","Check kOps release notes before using new VFS backends"],"tags":["aws","s3","vfs","kops","unsupported-backend"],"backgroundTag":"path-not-cluster-readable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}