k3s-io/k3s · error

s3 bucket name was not set

Error message

s3 bucket name was not set

What it means

After config resolution (flags, config file, or config secret) the S3 client factory validates that a bucket name is present. An empty Bucket makes MinIO client construction meaningless, so the call fails fast before any network I/O. Note this check happens after the client cache, so only a not-yet-cached configuration triggers it.

Source

Thrown at pkg/etcd/s3/s3.go:169

	}

	// used just for logging
	scheme := "https://"
	if etcdS3.Insecure {
		scheme = "http://"
	}

	// Try to get an existing client from cache.  The entire EtcdS3 struct
	// (including the key id and secret) is used as the cache key, but we only
	// print the endpoint and bucket name to avoid leaking creds into the logs.
	if client, ok := c.clientCache.Get(*etcdS3); ok {
		logrus.Infof("Reusing cached S3 client for endpoint=%q bucket=%q folder=%q", scheme+etcdS3.Endpoint, etcdS3.Bucket, etcdS3.Folder)
		return client, nil
	}
	logrus.Infof("Attempting to create new S3 client for endpoint=%q bucket=%q folder=%q", scheme+etcdS3.Endpoint, etcdS3.Bucket, etcdS3.Folder)

	if etcdS3.Bucket == "" {
		return nil, errors.New("s3 bucket name was not set")
	}
	tr := http.DefaultTransport.(*http.Transport).Clone()

	// Set this value so that the underlying transport round-tripper
	// doesn't try to auto decode the body of objects with
	// content-encoding set to `gzip`.
	// Ref: https://github.com/minio/minio-go/pull/752
	tr.DisableCompression = true

	// You can either disable SSL verification or use a custom CA bundle,
	// it doesn't make sense to do both - if verification is disabled,
	// the CA is not checked!
	if etcdS3.SkipSSLVerify {
		tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
	} else if etcdS3.EndpointCA != "" {
		tlsConfig, err := loadEndpointCAs(etcdS3.EndpointCA)
		if err != nil {
			return nil, err

View on GitHub (pinned to 6ba341e396)

Solutions

1. Set the bucket explicitly: --etcd-s3-bucket-name=<bucket> (and verify it exists and credentials may list it).
2. If using etcd-s3-config-secret, ensure the secret data contains a valid bucket name and re-run.
3. Double-check for trailing whitespace or empty-string overrides in config files that blank the flag value.

Example fix

# before
k3s etcd-snapshot save --s3 --etcd-s3-endpoint=s3.amazonaws.com --etcd-s3-access-key=... --etcd-s3-secret-key=...
# after
k3s etcd-snapshot save --s3 --etcd-s3-endpoint=s3.amazonaws.com --etcd-s3-bucket-name=my-bucket --etcd-s3-access-key=... --etcd-s3-secret-key=...

if etcdS3.Bucket == "" {
    return nil, errors.New("s3 bucket name was not set")
}
// guard in callers before touching S3:
if cfg.EtcdS3.Bucket == "" { /* refuse early, point at --etcd-s3-bucket-name */ }

When it happens

Trigger: Running etcd-snapshot save/list/prune --s3 with --etcd-s3-endpoint set but --etcd-s3-bucket-name omitted, or an etcd-s3-config secret whose data lacks the bucket key.

Common situations: Copy-pasted flag lists missing the bucket flag; secrets templating that silently drops the 'bucket' field; renaming a bucket without updating the config secret.

Related errors

• etcd-s3-timeout must be greater than 0s
• all cloud-provider functionality disabled by config
• critical configuration value mismatch between servers
• s3 configuration was not set
• proxy URL must include scheme and host

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/c6c77c88270427a1. Report an issue: GitHub.