{"record":{"id":"d2d8c3bf8b3caede","repo":"kubernetes/kops","slug":"error-building-gcs-client-v","errorCode":null,"errorMessage":"error building GCS client: %v","messagePattern":"error building GCS client: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/context.go","lineNumber":527,"sourceCode":"\tgcsPath := NewGSPath(c, bucket, u.Path)\n\treturn gcsPath, nil\n}\n\n// getGCSClient returns the google cloud storage client, caching it for future calls\nfunc (c *VFSContext) getGCSClient(ctx context.Context) (*storage.Client, error) {\n\tc.mutex.Lock()\n\tdefer c.mutex.Unlock()\n\n\tif c.cachedGCSClient != nil {\n\t\treturn c.cachedGCSClient, nil\n\t}\n\n\t// TODO: Should we fall back to read-only?\n\tscope := storage.ScopeFullControl\n\n\tgcsClient, err := storage.NewClient(ctx, option.WithScopes(scope))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building GCS client: %v\", err)\n\t}\n\n\tc.cachedGCSClient = gcsClient\n\treturn gcsClient, nil\n}\n\n// getSwiftClient returns the openstack switch client, caching it for future calls\nfunc (c *VFSContext) getSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {\n\tc.mutex.Lock()\n\tdefer c.mutex.Unlock()\n\n\tif c.swiftClient != nil {\n\t\treturn c.swiftClient, nil\n\t}\n\n\tswiftClient, err := NewSwiftClient(ctx)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":509,"sourceCodeEnd":545,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/context.go#L509-L545","documentation":"getGCSClient calls storage.NewClient (cloud.google.com/go/storage) with full-control scope and wraps any failure as \"error building GCS client\". This means Application Default Credentials / the GCS client could not be constructed at all, before any request was made.","triggerScenarios":"storage.NewClient failing due to: no Application Default Credentials found (GOOGLE_APPLICATION_CREDENTIALS unset and metadata server unavailable), unreadable/invalid credentials file, missing required IAM roles for the scope, or network failure reaching the OAuth token endpoint.","commonSituations":"Running kops on a non-GCE machine without GOOGLE_APPLICATION_CREDENTIALS; service-account JSON key file deleted or malformed; workload identity not configured on the GKE node; corporate firewall blocking oauth2.googleapis.com.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key with Storage Object Admin on the state bucket","Run the workload on GCE/GKE with the cloud-platform / full-control scope enabled, or configure workload identity","Test credentials independently: `gcloud auth application-default login` or `gsutil ls gs://<bucket>` with the same identity","Check network egress to oauth2.googleapis.com / storage.googleapis.com and any proxy configuration","Verify the credentials file has not expired (key deleted/rotated in GCP console)"],"exampleFix":"// before\nexport KOPS_STATE_STORE=gs://my-bucket\nkops create cluster ...   # no credentials available\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json\nexport KOPS_STATE_STORE=gs://my-bucket\nkops create cluster ...","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" { if _, err := google.FindDefaultCredentials(context.Background(), storage.ScopeFullControl); err != nil { return fmt.Errorf(\"no GCP credentials available: %v\", err) } }","typeGuard":null,"tryCatchPattern":"client, err := getGCSClient(ctx); if err != nil { if strings.Contains(err.Error(), \"error building GCS client\") { // check creds/network before retrying: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS } return err }","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS when running off GCE/GKE","Grant the service account Storage Object Admin on the state bucket","Verify egress to oauth2.googleapis.com from restricted networks","Pre-flight with `gsutil ls gs://<bucket>` using the same identity"],"tags":["gcs","authentication","google-cloud","credentials"],"backgroundTag":"gcs-client-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}