{"record":{"id":"ffa66c22a4b72609","repo":"kubernetes/kops","slug":"cannot-parse-secretstore-q-w","errorCode":null,"errorMessage":"cannot parse SecretStore %q: %w","messagePattern":"cannot parse SecretStore %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/kops-controller/pkg/server/server.go","lineNumber":106,"sourceCode":"\t\tserver:         server,\n\t\tverifier:       verifier,\n\t\tuncachedClient: uncachedClient,\n\t}\n\n\tconfigBase, err := vfsContext.BuildVfsPath(opt.ConfigBase)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse ConfigBase %q: %w\", opt.ConfigBase, err)\n\t}\n\ts.configBase = configBase\n\n\ts.keystore, s.keypairIDs, err = newKeystore(opt.Server.CABasePath, opt.Server.SigningCAs)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tp, err := vfsContext.BuildVfsPath(opt.SecretStore)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse SecretStore %q: %w\", opt.SecretStore, err)\n\t}\n\ts.secretStore = secrets.NewVFSSecretStore(nil, p)\n\n\tclientset, err := controllerclientset.New(vfsContext, configBase, opt.ClusterName, s.keystore, s.secretStore)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"building controller clientset: %w\", err)\n\t}\n\ts.clientset = clientset\n\n\tchallengeClient, err := bootstrap.NewChallengeClient(s.keystore)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ts.challengeClient = challengeClient\n\n\tr := http.NewServeMux()\n\tr.Handle(\"/healthz\", http.HandlerFunc(healthCheck))\n\tr.Handle(\"/bootstrap\", http.HandlerFunc(s.bootstrap))","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/pkg/server/server.go#L88-L124","documentation":"NewServer parses the configured SecretStore VFS path (e.g. s3://... or memory://) with vfsContext.BuildVfsPath; this wraps that parse failing, meaning the SecretStore string in the kops-controller configuration is not a valid VFS path.","triggerScenarios":"vfsContext.BuildVfsPath(opt.SecretStore) fails because --secret-store is malformed, has an unsupported scheme, or is empty.","commonSituations":"Missing --secret-store flag value; typo'd path; unsupported storage backend scheme; quoting issues in systemd unit or container args.","solutions":["Inspect the wrapped parse error","Provide a valid VFS path for --secret-store (same backend as cluster state)","Match the secret store path recorded in the cluster spec","Verify backend scheme support in the kops-controller build"],"exampleFix":"// before\n--secret-store=--s3://bucket/secrets\n// after\n--secret-store=s3://bucket/cluster/secrets","handlingStrategy":"validation","validationCode":"if opt.SecretStore == \"\" || !strings.Contains(opt.SecretStore, \"://\") {\n    return fmt.Errorf(\"--secret-store must be a non-empty VFS path\")\n}","typeGuard":null,"tryCatchPattern":"p, err := vfsContext.BuildVfsPath(opt.SecretStore)\nif err != nil {\n    return nil, fmt.Errorf(\"cannot parse SecretStore %q: %w\", opt.SecretStore, err)\n}","preventionTips":["Set --secret-store to the cluster's state-store-based secrets path","Use the same backend scheme as --config-base","Smoke-test the path with kops get secrets"],"tags":["go","vfs","secrets","cli-options"],"backgroundTag":"invalid-vfs-path","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}