kubernetes/kops · error

cannot determine hash for

Error message

cannot determine hash for %q (have you specified a valid file location?)

What it means

findHash could not determine the SHA256 hash for the given URL: it was not in the well-known hash table, no .sha256 hash file was published alongside the file (common for older Kubernetes releases), and download-based hashing failed or was not possible. kops cannot verify the asset, so it refuses to continue.

Solutions

1. Check the file location URL is correct and reachable (curl it).
2. Use a supported Kubernetes version whose release publishes .sha256 files.
3. Ensure network/egress (or proxy) allows kops to download the file to compute its hash.
4. If using a file repository, stage the file plus its .sha256 via 'kops get assets --copy'.

Example fix

// before
--kubernetes-version=1.15.3 # no published .sha256, air-gapped env
// after
--kubernetes-version=1.28.9 # supported release with .sha256 files
# or ensure https://storage.googleapis.com/kubernetes-release/release/... is reachable / proxied

// verify the file (and .sha256) are reachable before remapping
resp, err := http.Head(u.String())
if err != nil || resp.StatusCode != 200 {
	return fmt.Errorf("cannot reach %q to determine hash", u)
}

fileAsset, err := assetBuilder.RemapFile(u, knownHash)
if err != nil {
	if strings.Contains(err.Error(), "cannot determine hash") {
		// fall back: pre-download the file and pass a knownHash computed locally
		return fallbackHashAndRemap(u)
	}
	return err
}

When it happens

Trigger: RemapFile on a file URL with no known hash, no sibling .sha256 file, and no successful download to compute the hash — e.g. unsupported/old Kubernetes release or unreachable download source.

Common situations: Pinning an old/unsupported k8s version that predates published sha256 files; air-gapped clusters where the canonical download URL is unreachable; typo in the file location/URL.

Related errors

• error adding asset
• file url is not defined
• unknown hash algorithm
• you might have not staged your files correctly, please…
• addon manifest hash was not populated

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/63e6f8edcd0590d5. Report an issue: GitHub.

Appendix: source

Thrown at pkg/assets/builder.go:444

				hash, err := hashing.FromString(fields[0])
				if err != nil {
					return nil, err
				}

				downloadedFileHashes.Store(u.String(), hash)

				return hash, nil
			}
			if ext == ".sha256" {
				klog.V(2).Infof("Unable to read new sha256 hash file (is this an older/unsupported kubernetes release?)")
			}
		}
	}

	if a.assetsLocation != nil && a.assetsLocation.FileRepository != nil {
		return nil, fmt.Errorf("you might have not staged your files correctly, please execute 'kops get assets --copy'")
	}
	return nil, fmt.Errorf("cannot determine hash for %q (have you specified a valid file location?)", u)
}

func (a *AssetBuilder) remapURL(canonicalURL *url.URL) (*url.URL, error) {
	f := ""
	if a.assetsLocation != nil {
		f = values.StringValue(a.assetsLocation.FileRepository)
	}
	if f == "" {
		return nil, fmt.Errorf("assetsLocation.fileRepository must be set to remap asset %v", canonicalURL)
	}

	fileRepo, err := url.Parse(f)
	if err != nil {
		return nil, fmt.Errorf("unable to parse assetsLocation.fileRepository %q: %v", f, err)
	}

	fileRepo.Path = path.Join(fileRepo.Path, canonicalURL.Path)
	// Escape commas, which are legal in a path but separate locations in CompactString.

View on GitHub (pinned to 4c8573c808)