{"record":{"id":"ed618087535de08b","repo":"kubernetes/kops","slug":"reading-kops-channels-manifest-s-w","errorCode":null,"errorMessage":"reading kops-channels manifest %s: %w","messagePattern":"reading kops-channels manifest (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/channels.go","lineNumber":95,"sourceCode":"\tc.AddTask(&nodetasks.File{\n\t\tPath:     channelsManifestPath,\n\t\tContents: fi.NewBytesResource(manifest),\n\t\tType:     nodetasks.FileType_File,\n\t})\n\treturn nil\n}\n\n// readChannelsManifest fetches the cloudup-built manifest and applies node-local SELinux\n// decoration when needed. Otherwise it passes the bytes through unchanged.\nfunc (b *ChannelsBuilder) readChannelsManifest(c *fi.NodeupModelBuilderContext) ([]byte, error) {\n\tctx := c.Context()\n\tp, err := vfs.Context.BuildVfsPath(b.NodeupConfig.ChannelsManifest)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing path for kops-channels manifest %s: %w\", b.NodeupConfig.ChannelsManifest, err)\n\t}\n\tdata, err := p.ReadFile(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading kops-channels manifest %s: %w\", b.NodeupConfig.ChannelsManifest, err)\n\t}\n\n\t// SELinux is per-IG via containerdConfig, so the decoration can only be applied at nodeup.\n\t// Skip the parse/reserialize round-trip when there's nothing to add.\n\tif b.NodeupConfig.ContainerdConfig == nil || !b.NodeupConfig.ContainerdConfig.SeLinuxEnabled {\n\t\treturn data, nil\n\t}\n\tpod := &v1.Pod{}\n\tif err := yaml.Unmarshal(data, pod); err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing kops-channels manifest: %w\", err)\n\t}\n\tkubemanifest.AddHostPathSELinuxContext(pod, b.NodeupConfig)\n\tout, err := k8scodecs.ToVersionedYaml(pod)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"re-marshaling kops-channels manifest: %w\", err)\n\t}\n\treturn out, nil\n}","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/channels.go#L77-L113","documentation":"After successfully parsing the VFS path, readChannelsManifest calls p.ReadFile(ctx) to fetch the kops-channels manifest bytes from the state store. Any read failure (missing object, denied credentials, network error, backend outage) is wrapped with this message, aborting the nodeup Build for master nodes.","triggerScenarios":"Build() on a master node; VFS path is valid but ReadFile fails because the manifest object does not exist, the node lacks IAM/credentials for the state store, there is a network outage, or the object is not readable.","commonSituations":"S3/GCS bucket deleted or object removed; instance profile lacks s3:GetObject on the state bucket; DNS or egress outage on the node; manifest never uploaded because 'kops update cluster' was interrupted.","solutions":["Verify the manifest object exists at the ChannelsManifest path in the state store (aws s3 ls / gsutil ls) and re-run 'kops update cluster' if missing.","Check the node's cloud credentials/IAM permissions to read the state store bucket.","Test connectivity from the node to the backend (S3/GCS endpoint, DNS resolution).","Re-run nodeup once backend access is restored; wrap checks in a pre-flight read of the path."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-flight: confirm the object is readable before nodeup\np, err := vfs.Context.BuildVfsPath(cfg.ChannelsManifest)\nif err == nil {\n\tif _, err := p.ReadFile(context.Background()); err != nil {\n\t\tlog.Printf(\"warning: channels manifest not readable: %v\", err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := nodeupRun(ctx); err != nil && strings.Contains(err.Error(), \"reading kops-channels manifest\") {\n\t// transient backend/network issue: backoff and retry\n\ttime.Sleep(30 * time.Second)\n\treturn nodeupRun(ctx)\n}","preventionTips":["Grant instance profiles/service accounts read access to the state-store bucket.","Monitor state-store availability and object existence after every 'kops update cluster'.","Check node egress/DNS to S3/GCS endpoints before nodeup runs.","Re-run 'kops update cluster --yes' if a prior apply was interrupted."],"tags":["go","nodeup","vfs","state-store","network"],"backgroundTag":"state-store-read-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}