kubernetes/kops · error

building VFS path for %q: %w

Error message

building VFS path for %q: %w

What it means

vfs.Context.BuildVfsPath parses the discoveryStore URI from cluster.spec.serviceAccountIssuerDiscovery.discoveryStore into a concrete VFS path (e.g. s3://, gs://, memfs://). This error wraps any parse/credential/registry failure, meaning the store path string is malformed or no VFS path implementation is registered for its scheme.

Source

Thrown at pkg/model/issuerdiscovery.go:85

	}

	skTask := signingKeyTaskObject.(*fitasks.Keypair)

	keys := &OIDCKeys{
		SigningKey: skTask,
	}

	discovery, err := buildDiscoveryJSON(*b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer)
	if err != nil {
		return err
	}

	var publicFileACL *bool

	discoveryStorePath := b.Cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore
	discoveryStore, err := vfs.Context.BuildVfsPath(discoveryStorePath)
	if err != nil {
		return fmt.Errorf("building VFS path for %q: %w", discoveryStorePath, err)
	}

	switch discoveryStore := discoveryStore.(type) {
	case *vfs.S3Path:
		discoveryStoreURL, err := discoveryStore.GetHTTPsUrl(b.Cluster.Spec.IsIPv6Only())
		if err != nil {
			return err
		}
		if discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {
			// Using Amazon S3 static website hosting requires public access
			isPublic, err := discoveryStore.IsBucketPublic(ctx)
			if err != nil {
				return fmt.Errorf("checking if bucket was public: %w", err)
			}
			if !isPublic {
				klog.Infof("serviceAccountIssuers bucket %q is not public; will use object ACL", discoveryStore.Bucket())
				publicFileACL = new(true)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the discoveryStore value to a supported scheme: s3://bucket/prefix (AWS) or gs://bucket/prefix (GCP).
2. Verify for typos/whitespace: `kops get cluster -o yaml | grep discoveryStore`.
3. Confirm cloud provider matches the scheme (S3 path for AWS clusters, GS path for GCP clusters).
4. If the scheme is correct but credentials/cloud SDK are missing, fix the environment so the VFS client can be constructed.

Example fix

// before
spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: s3/oidc-bucket
// after
spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: s3://oidc-bucket/cluster.example.com

// Validate discoveryStore before applying the cluster:
store := cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore
u, err := url.Parse(store)
if err != nil || u.Scheme == "" {
    return fmt.Errorf("discoveryStore %q must be a URI with scheme s3:// or gs://", store)
}
if u.Scheme != "s3" && u.Scheme != "gs" {
    return fmt.Errorf("unsupported discoveryStore scheme %q; use s3:// or gs://", u.Scheme)
}

if err := runUpdate(); err != nil {
    if strings.Contains(err.Error(), "building VFS path for") {
        log.Printf("check serviceAccountIssuerDiscovery.discoveryStore URI: %v", err)
    }
}

When it happens

Trigger: `kops update cluster` with an unparseable discoveryStore value such as a relative path, a URL with an unsupported scheme (e.g. azureblob://, file:// without VFS support), or a syntactically invalid URI.

Common situations: Typos in the discoveryStore setting (missing scheme, stray spaces), copying a store path from another cloud provider (GS path on an AWS cluster context without gs support compiled in), or using a scheme kops' VFS registry does not handle.

Related errors

• cannot parse VFS path %q: %v
• path is not cluster readable: %v
• unhandled type %T
• error loading NodeupConfig %q: %v
• error reading addons from %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1601dfe8c753a579. Report an issue: GitHub.