{"record":{"id":"b8936512af341238","repo":"kubernetes/kops","slug":"unhandled-type-t","errorCode":null,"errorMessage":"unhandled type %T","messagePattern":"unhandled type %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/issuerdiscovery.go","lineNumber":130,"sourceCode":"\t\tif discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {\n\t\t\t// Using Google Cloud Storage requires public access\n\t\t\tisPublic, err := discoveryStore.IsBucketPublic(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"checking if bucket was public: %w\", err)\n\t\t\t}\n\t\t\tif !isPublic {\n\t\t\t\tklog.Infof(\"serviceAccountIssuers bucket %q is not public; will use object ACL\", discoveryStore.Bucket())\n\t\t\t\tpublicFileACL = new(true)\n\t\t\t}\n\t\t} else {\n\t\t\tklog.Infof(\"using user managed serviceAccountIssuers\")\n\t\t}\n\n\tcase *vfs.MemFSPath:\n\t\t// ok\n\n\tdefault:\n\t\treturn fmt.Errorf(\"unhandled type %T\", discoveryStore)\n\t}\n\n\tkeysFile := &fitasks.ManagedFile{\n\t\tContents:  keys,\n\t\tLifecycle: b.Lifecycle,\n\t\tLocation:  new(\"openid/v1/jwks\"),\n\t\tName:      new(\"keys.json\"),\n\t\tBase:      new(discoveryStorePath),\n\t\tPublicACL: publicFileACL,\n\t}\n\tc.AddTask(keysFile)\n\n\tdiscoveryFile := &fitasks.ManagedFile{\n\t\tContents:  fi.NewBytesResource(discovery),\n\t\tLifecycle: b.Lifecycle,\n\t\tLocation:  new(\".well-known/openid-configuration\"),\n\t\tName:      new(\"discovery.json\"),\n\t\tBase:      new(discoveryStorePath),","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/issuerdiscovery.go#L112-L148","documentation":"The discoveryStore VFS path parsed to a concrete type kops' IssuerDiscoveryModelBuilder does not support. The builder only handles *vfs.S3Path, *vfs.GSPath and *vfs.MemFSPath; any other VFS implementation (e.g. a filesystem or vault path) reaches the default branch and fails with the Go type name of the unhandled path.","triggerScenarios":"`kops update cluster` with cluster.spec.serviceAccountIssuerDiscovery.discoveryStore set to a supported-to-parse but unsupported-for-publishing path, e.g. file://, /local/path, vfs:/// or another non-S3/non-GS VFS scheme.","commonSituations":"Pointing discoveryStore at a local filesystem path during testing and forgetting to switch to s3:// or gs://, using an OSS/Azure/DO storage URL that VFS parses but the OIDC publisher does not implement, or running on a cloud provider whose builder adds no discovery-store support.","solutions":["Change discoveryStore to an S3 or GCS bucket path: s3://bucket/prefix or gs://bucket/prefix.","If testing locally, use a memfs:// path (handled as a no-op) rather than a file:// path.","Check the kops docs for supported OIDC discovery stores for your cloud provider; other clouds require serving discovery via a different mechanism (e.g. configStore with an external web server).","Remove serviceAccountIssuerDiscovery entirely if you serve OIDC discovery out-of-band."],"exampleFix":"// before\nspec:\n  serviceAccountIssuerDiscovery:\n    discoveryStore: /mnt/oidc\n// after\nspec:\n  serviceAccountIssuerDiscovery:\n    discoveryStore: s3://my-oidc-bucket/cluster.example.com","handlingStrategy":"validation","validationCode":"// Narrow the discoveryStore to supported backends before applying:\nstore := cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore\nswitch {\ncase strings.HasPrefix(store, \"s3://\"), strings.HasPrefix(store, \"gs://\"), strings.HasPrefix(store, \"memfs://\"):\n    // supported\ndefault:\n    return fmt.Errorf(\"discoveryStore %q unsupported: only s3://, gs:// (or memfs:// for tests) are handled\", store)\n}","typeGuard":"func isSupportedDiscoveryStore(store string) bool {\n    return strings.HasPrefix(store, \"s3://\") || strings.HasPrefix(store, \"gs://\") || strings.HasPrefix(store, \"memfs://\")\n}","tryCatchPattern":null,"preventionTips":["Only use s3:// or gs:// for serviceAccountIssuerDiscovery.discoveryStore.","Never point discoveryStore at local/file paths in real cluster specs.","For other clouds, serve OIDC discovery externally instead of setting discoveryStore.","Validate the spec against kops' documented supported discovery stores before `kops update`."],"tags":["kops","vfs","unsupported-storage","configuration"],"backgroundTag":"unsupported-storage-backend","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}