kubernetes/kops · critical

cannot parse SecretStore %q: %w

Error message

cannot parse SecretStore %q: %w

What it means

NewServer parses the configured SecretStore VFS path (e.g. s3://... or memory://) with vfsContext.BuildVfsPath; this wraps that parse failing, meaning the SecretStore string in the kops-controller configuration is not a valid VFS path.

Source

Thrown at cmd/kops-controller/pkg/server/server.go:106

		server:         server,
		verifier:       verifier,
		uncachedClient: uncachedClient,
	}

	configBase, err := vfsContext.BuildVfsPath(opt.ConfigBase)
	if err != nil {
		return nil, fmt.Errorf("cannot parse ConfigBase %q: %w", opt.ConfigBase, err)
	}
	s.configBase = configBase

	s.keystore, s.keypairIDs, err = newKeystore(opt.Server.CABasePath, opt.Server.SigningCAs)
	if err != nil {
		return nil, err
	}

	p, err := vfsContext.BuildVfsPath(opt.SecretStore)
	if err != nil {
		return nil, fmt.Errorf("cannot parse SecretStore %q: %w", opt.SecretStore, err)
	}
	s.secretStore = secrets.NewVFSSecretStore(nil, p)

	clientset, err := controllerclientset.New(vfsContext, configBase, opt.ClusterName, s.keystore, s.secretStore)
	if err != nil {
		return nil, fmt.Errorf("building controller clientset: %w", err)
	}
	s.clientset = clientset

	challengeClient, err := bootstrap.NewChallengeClient(s.keystore)
	if err != nil {
		return nil, err
	}
	s.challengeClient = challengeClient

	r := http.NewServeMux()
	r.Handle("/healthz", http.HandlerFunc(healthCheck))
	r.Handle("/bootstrap", http.HandlerFunc(s.bootstrap))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped parse error
2. Provide a valid VFS path for --secret-store (same backend as cluster state)
3. Match the secret store path recorded in the cluster spec
4. Verify backend scheme support in the kops-controller build

Example fix

// before
--secret-store=--s3://bucket/secrets
// after
--secret-store=s3://bucket/cluster/secrets

if opt.SecretStore == "" || !strings.Contains(opt.SecretStore, "://") {
    return fmt.Errorf("--secret-store must be a non-empty VFS path")
}

p, err := vfsContext.BuildVfsPath(opt.SecretStore)
if err != nil {
    return nil, fmt.Errorf("cannot parse SecretStore %q: %w", opt.SecretStore, err)
}

When it happens

Trigger: vfsContext.BuildVfsPath(opt.SecretStore) fails because --secret-store is malformed, has an unsupported scheme, or is empty.

Common situations: Missing --secret-store flag value; typo'd path; unsupported storage backend scheme; quoting issues in systemd unit or container args.

Related errors

• error loading secret %q: %w
• cannot parse ConfigBase %q: %w
• ReadOnlyError
• unexpected kind for cluster, got %T, want kops.Cluster
• method ConfigBaseFor not supported in server-side client

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ffa66c22a4b72609. Report an issue: GitHub.