{"record":{"id":"e5f224bea0198b16","repo":"kubernetes/kops","slug":"configstore-base-path-is-not-cluster-readable-v","errorCode":null,"errorMessage":"ConfigStore.Base path is not cluster readable: %v","messagePattern":"ConfigStore\\.Base path is not cluster readable: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/populate_cluster_spec.go","lineNumber":170,"sourceCode":"\t\t\t\t\tetcdNames[m.Name] = m\n\t\t\t\t\tetcdInstanceGroups[instanceGroupName] = m\n\t\t\t\t}\n\n\t\t\t\tif (len(etcdNames) % 2) == 0 {\n\t\t\t\t\t// Not technically a requirement, but doesn't really make sense to allow\n\t\t\t\t\treturn fmt.Errorf(\"there should be an odd number of control-plane-zones, for etcd's quorum.  Hint: Use --zones and --control-plane-zones to declare worker and control plane node zones separately\")\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tconfigBase, err := clientset.VFSContext().BuildVfsPath(cluster.Spec.ConfigStore.Base)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error parsing ConfigStore.Base %q: %v\", cluster.Spec.ConfigStore.Base, err)\n\t}\n\tif !vfs.IsClusterReadable(configBase) {\n\t\t// We could implement this approach, but it seems better to get all clouds using cluster-readable storage\n\t\treturn fmt.Errorf(\"ConfigStore.Base path is not cluster readable: %v\", cluster.Spec.ConfigStore.Base)\n\t}\n\n\tkeyStore, err := clientset.KeyStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif cluster.Spec.ConfigStore.Keypairs == \"\" {\n\t\thasVFSPath, ok := keyStore.(fi.HasVFSPath)\n\t\tif !ok {\n\t\t\t// We will mirror to ConfigBase\n\t\t\tbasedir := configBase.Join(\"pki\")\n\t\t\tcluster.Spec.ConfigStore.Keypairs = basedir.Path()\n\t\t} else if vfs.IsClusterReadable(hasVFSPath.VFSPath()) {\n\t\t\tvfsPath := hasVFSPath.VFSPath()\n\t\t\tcluster.Spec.ConfigStore.Keypairs = vfsPath.Path()\n\t\t} else {\n\t\t\t// We could implement this approach, but it seems better to get all clouds using cluster-readable storage","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/populate_cluster_spec.go#L152-L188","documentation":"Cluster configuration must be stored on storage that nodes in the cluster can read (nodeup fetches config from VFS). run() throws this when the parsed ConfigStore.Base VFS path is not \"cluster readable\" — e.g. a memfs path or a path the cluster's nodes have no credentials to access.","triggerScenarios":"PopulateClusterSpec with configStore.base set to a scheme that vfs.IsClusterReadable rejects, such as memfs://, or a VFS path backed by storage lacking node-readable permissions (e.g. a bucket with no IAM access from instances).","commonSituations":"Using an in-memory/test state store path in a real cluster; S3 bucket without a bucket policy granting access to cluster nodes (no IAM instance profile access); switching cloud providers but keeping a foreign state store URL.","solutions":["Set configStore.base to a cluster-readable location, e.g. s3://<bucket> with an IAM policy granting the node instance profiles read access.","Verify bucket permissions: nodes' IAM roles need s3:GetObject/ListBucket on the state bucket.","Avoid memfs:// or other local-only schemes; use the cloud object store matching your cloud provider."],"exampleFix":"# before\nconfigStore:\n  base: memfs://clusters.example.com\n# after\nconfigStore:\n  base: s3://my-kops-state-bucket/cluster.example.com","handlingStrategy":"validation","validationCode":"if !strings.HasPrefix(cluster.Spec.ConfigStore.Base, \"s3://\") && !strings.HasPrefix(cluster.Spec.ConfigStore.Base, \"gs://\") {\n\treturn fmt.Errorf(\"state store must be a cloud object store readable by nodes\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the cloud's object store (S3/GCS) for state, never memfs/file for real clusters","Grant node IAM instance profiles read access to the state bucket","Verify cross-account bucket policies allow the cluster's accounts"],"tags":["vfs","storage-permissions","state-store"],"backgroundTag":"invalid-storage-path","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}