kubernetes/kops · error

cannot parse cluster path %q: %w

Error message

cannot parse cluster path %q: %w

What it means

Parsing the cluster's config base (state store location) as a VFS path failed while building storage ACLs; the configured config path is not a well-formed VFS URI.

Source

Thrown at pkg/model/gcemodel/storageacl.go:61

// Build creates the tasks that set up storage acls

func (b *StorageAclBuilder) Build(c *fi.CloudupModelBuilderContext) error {
	if featureflag.GoogleCloudBucketACL.Enabled() {
		if b.Cluster.Spec.CloudProvider.GCE.ServiceAccount == "" {
			return fmt.Errorf("featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount")
		}

		klog.Warningf("featureflag GoogleCloudBucketACL is no longer recommended; use per-instancegroup GCEServiceAccounts instead")

		gceDefaultServiceAccount, err := b.Cloud.ServiceAccount()
		if err != nil {
			return fmt.Errorf("error fetching default ServiceAccount: %w", err)
		}

		clusterPath := b.Cluster.Spec.ConfigStore.Base
		p, err := vfs.Context.BuildVfsPath(clusterPath)
		if err != nil {
			return fmt.Errorf("cannot parse cluster path %q: %w", clusterPath, err)
		}

		if p, ok := p.(*vfs.GSPath); ok {
			// It's not ideal that we have to do this at the bucket level,
			// but GCS doesn't seem to have a way to do subtrees (like AWS IAM does)
			// Note this permission only lets us list objects, not read them
			c.AddTask(&gcetasks.StorageBucketAcl{
				Name:      s("serviceaccount-statestore-list"),
				Lifecycle: b.Lifecycle,
				Bucket:    s(p.Bucket()),
				Entity:    s("user-" + gceDefaultServiceAccount),
				Role:      s("READER"),
			})
		}

		klog.Warningf("we need to split control-plane / worker node roles")
		nodeRole, err := iam.BuildNodeRoleSubject(kops.InstanceGroupRoleControlPlane, false)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the cluster's configBase/state-store path syntax (e.g. s3://bucket/path)
2. Correct the state store setting and re-export the cluster
3. Avoid unsupported URI schemes

When it happens

Trigger: Thrown at pkg/model/gcemodel/storageacl.go:61 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8b87a9223758e286. Report an issue: GitHub.