{"record":{"id":"d4348815848585dd","repo":"kubernetes/kops","slug":"error-querying-bucket-q-v","errorCode":null,"errorMessage":"error querying bucket %q: %v","messagePattern":"error querying bucket %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/acls/gce/storage.go","lineNumber":56,"sourceCode":"func (s *gcsAclStrategy) GetACL(ctx context.Context, p vfs.Path, cluster *kops.Cluster) (vfs.ACL, error) {\n\tif cluster.GetCloudProvider() != kops.CloudProviderGCE {\n\t\treturn nil, nil\n\t}\n\tgcsPath, ok := p.(*vfs.GSPath)\n\tif !ok {\n\t\treturn nil, nil\n\t}\n\n\tbucketName := gcsPath.Bucket()\n\tclient, err := gcsPath.Client(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// TODO: Cache?\n\tbucket, err := client.Bucket(bucketName).Attrs(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying bucket %q: %v\", bucketName, err)\n\t}\n\n\tif bucket.UniformBucketLevelAccess.Enabled {\n\t\tklog.V(8).Infof(\"bucket gs://%s has bucket-policy only; won't try to set ACLs\", bucketName)\n\t\treturn nil, nil\n\t}\n\n\t// TODO: Cache?\n\tcloud, err := cloudup.BuildCloud(cluster)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tserviceAccount, err := cloud.(gce.GCECloud).ServiceAccount()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/acls/gce/storage.go#L38-L74","documentation":"GetACL queries a GCS bucket's metadata to determine whether it enforces uniform bucket-level access. When the storage.Client call to Bucket(bucketName).Attrs(ctx) fails (network error, missing bucket, insufficient permissions), the underlying GCS error is wrapped as `error querying bucket %q: %v` and returned so callers know which bucket could not be inspected.","triggerScenarios":"Calling vfs GetACL against a gs:// path whose bucket name is wrong/typo'd, the bucket does not exist or was deleted, the credentials lack storage.buckets.get (e.g. missing storage.admin or objectViewer+bucketViewer roles), or a transient network/API failure occurs while calling the GCS Storage API.","commonSituations":"Misconfigured KOPS_STATE_STORE gs:// bucket name; using service-account credentials that only have object-level permissions on a bucket with uniform bucket-level access; buckets removed between cluster operations; flaky connectivity or GCS API outages during `kops get/export` against a GCS state store.","solutions":["Verify the bucket name in your state store URL exactly matches an existing bucket (gsutil ls or gcloud storage buckets describe).","Grant the service account storage.buckets.get access (roles/storage.admin or at minimum roles/storage.objectViewer plus bucketViewer/legacyBucketReader).","Check GOOGLE_APPLICATION_CREDENTIALS points to a valid, non-expired service-account key.","Retry if the underlying error is transient (timeouts, 5xx, 429 rate limits)."],"exampleFix":"// before (insufficient perms)\nclient, _ := storage.NewClient(ctx)\nacl, err := vfs.GetACL(ctx, path, cluster) // error querying bucket \"my-bucket\": googleapi: Error 403\n// after: grant IAM first\ngcloud storage buckets add-iam-policy-binding gs://my-bucket \\\n  --member=serviceAccount:sa@project.iam.gserviceaccount.com \\\n  --role=roles/storage.admin","handlingStrategy":"try-catch","validationCode":"// Go: check bucket exists & is accessible before GetACL\nclient, err := storage.NewClient(ctx)\nif err != nil { return err }\n_, err = client.Bucket(\"my-bucket\").Attrs(ctx)\nif err != nil {\n    if e, ok := err.(*googleapi.Error); ok && e.Code == 404 {\n        return fmt.Errorf(\"bucket my-bucket does not exist\")\n    }\n    return err\n}","typeGuard":"func isGoogleAPIError(err error) (*googleapi.Error, bool) {\n    var ge *googleapi.Error\n    if errors.As(err, &ge) { return ge, true }\n    return nil, false\n}","tryCatchPattern":"acl, err := vfs.GetACL(ctx, path, cluster)\nif err != nil {\n    var ge *googleapi.Error\n    if errors.As(err, &ge) {\n        switch ge.Code {\n        case 404: // bucket missing: create it or fix state store URL\n        case 403: // grant storage.buckets.get IAM\n        case 429, 500, 503: // retry with backoff\n        }\n    }\n    return err\n}","preventionTips":["Pin KOPS_STATE_STORE to a verified gs:// bucket name in CI","Grant the service account roles/storage.admin (or bucket-reader) before running kops","Validate GOOGLE_APPLICATION_CREDENTIALS at pipeline start","Add retry-with-backoff for transient GCS 5xx/429 errors"],"tags":["gcp","gcs","permissions","storage"],"backgroundTag":"gcs-bucket-query-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}