{"record":{"id":"ddf04881973e573b","repo":"kubernetes/kops","slug":"error-fetching-default-serviceaccount-w","errorCode":null,"errorMessage":"error fetching default ServiceAccount: %w","messagePattern":"error fetching default ServiceAccount: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/gcemodel/storageacl.go","lineNumber":55,"sourceCode":"\tCloud     gce.GCECloud\n\tLifecycle fi.Lifecycle\n}\n\nvar _ fi.CloudupModelBuilder = &StorageAclBuilder{}\n\n// Build creates the tasks that set up storage acls\n\nfunc (b *StorageAclBuilder) Build(c *fi.CloudupModelBuilderContext) error {\n\tif featureflag.GoogleCloudBucketACL.Enabled() {\n\t\tif b.Cluster.Spec.CloudProvider.GCE.ServiceAccount == \"\" {\n\t\t\treturn fmt.Errorf(\"featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount\")\n\t\t}\n\n\t\tklog.Warningf(\"featureflag GoogleCloudBucketACL is no longer recommended; use per-instancegroup GCEServiceAccounts instead\")\n\n\t\tgceDefaultServiceAccount, err := b.Cloud.ServiceAccount()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error fetching default ServiceAccount: %w\", err)\n\t\t}\n\n\t\tclusterPath := b.Cluster.Spec.ConfigStore.Base\n\t\tp, err := vfs.Context.BuildVfsPath(clusterPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot parse cluster path %q: %w\", clusterPath, err)\n\t\t}\n\n\t\tif p, ok := p.(*vfs.GSPath); ok {\n\t\t\t// It's not ideal that we have to do this at the bucket level,\n\t\t\t// but GCS doesn't seem to have a way to do subtrees (like AWS IAM does)\n\t\t\t// Note this permission only lets us list objects, not read them\n\t\t\tc.AddTask(&gcetasks.StorageBucketAcl{\n\t\t\t\tName:      s(\"serviceaccount-statestore-list\"),\n\t\t\t\tLifecycle: b.Lifecycle,\n\t\t\t\tBucket:    s(p.Bucket()),\n\t\t\t\tEntity:    s(\"user-\" + gceDefaultServiceAccount),\n\t\t\t\tRole:      s(\"READER\"),","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/gcemodel/storageacl.go#L37-L73","documentation":"Fetching the GCE project's default service account from the cloud API failed while configuring storage bucket ACLs; a GCE API or permission error, before any ACL task is built.","triggerScenarios":"Thrown at pkg/model/gcemodel/storageacl.go:55 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the credentials can read the project's service accounts","Verify the GCP project configuration","Retry after resolving API access"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}