kubernetes/kops · error

cannot determine hash for %q (have you specified a valid fil

Error message

cannot determine hash for %q (have you specified a valid file location?)

What it means

findHash could not determine the SHA256 hash for the given URL: it was not in the well-known hash table, no .sha256 hash file was published alongside the file (common for older Kubernetes releases), and download-based hashing failed or was not possible. kops cannot verify the asset, so it refuses to continue.

Source

Thrown at pkg/assets/builder.go:444

				hash, err := hashing.FromString(fields[0])
				if err != nil {
					return nil, err
				}

				downloadedFileHashes.Store(u.String(), hash)

				return hash, nil
			}
			if ext == ".sha256" {
				klog.V(2).Infof("Unable to read new sha256 hash file (is this an older/unsupported kubernetes release?)")
			}
		}
	}

	if a.assetsLocation != nil && a.assetsLocation.FileRepository != nil {
		return nil, fmt.Errorf("you might have not staged your files correctly, please execute 'kops get assets --copy'")
	}
	return nil, fmt.Errorf("cannot determine hash for %q (have you specified a valid file location?)", u)
}

func (a *AssetBuilder) remapURL(canonicalURL *url.URL) (*url.URL, error) {
	f := ""
	if a.assetsLocation != nil {
		f = values.StringValue(a.assetsLocation.FileRepository)
	}
	if f == "" {
		return nil, fmt.Errorf("assetsLocation.fileRepository must be set to remap asset %v", canonicalURL)
	}

	fileRepo, err := url.Parse(f)
	if err != nil {
		return nil, fmt.Errorf("unable to parse assetsLocation.fileRepository %q: %v", f, err)
	}

	fileRepo.Path = path.Join(fileRepo.Path, canonicalURL.Path)
	// Escape commas, which are legal in a path but separate locations in CompactString.

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the file location URL is correct and reachable (curl it).
2. Use a supported Kubernetes version whose release publishes .sha256 files.
3. Ensure network/egress (or proxy) allows kops to download the file to compute its hash.
4. If using a file repository, stage the file plus its .sha256 via 'kops get assets --copy'.

Example fix

// before
--kubernetes-version=1.15.3 # no published .sha256, air-gapped env
// after
--kubernetes-version=1.28.9 # supported release with .sha256 files
# or ensure https://storage.googleapis.com/kubernetes-release/release/... is reachable / proxied

// verify the file (and .sha256) are reachable before remapping
resp, err := http.Head(u.String())
if err != nil || resp.StatusCode != 200 {
	return fmt.Errorf("cannot reach %q to determine hash", u)
}

fileAsset, err := assetBuilder.RemapFile(u, knownHash)
if err != nil {
	if strings.Contains(err.Error(), "cannot determine hash") {
		// fall back: pre-download the file and pass a knownHash computed locally
		return fallbackHashAndRemap(u)
	}
	return err
}

When it happens

Trigger: RemapFile on a file URL with no known hash, no sibling .sha256 file, and no successful download to compute the hash — e.g. unsupported/old Kubernetes release or unreachable download source.

Common situations: Pinning an old/unsupported k8s version that predates published sha256 files; air-gapped clusters where the canonical download URL is unreachable; typo in the file location/URL.

Related errors

• file url is not defined
• you might have not staged your files correctly, please execu
• error adding asset %q: %v
• unknown hash algorithm: %q
• error hashing manifest: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/63e6f8edcd0590d5. Report an issue: GitHub.