kubernetes/kops · error

cannot parse VFS path %q: %v

Error message

cannot parse VFS path %q: %v

What it means

Building a VFS path from a state path that needs bucket-read IAM binding failed; one of the cluster's configured state/config paths is not a parseable VFS URI.

Source

Thrown at pkg/model/gcemodel/storageacl.go:188

			c.AddTask(&gcetasks.StorageBucketIAM{
				Name:                 s("objectadmin-" + bucket + "-serviceaccount-" + nameForTask),
				Lifecycle:            b.Lifecycle,
				Bucket:               s(bucket),
				MemberServiceAccount: serviceAccountRole.ServiceAccount,
				Role:                 s("roles/storage.objectAdmin"),
			})
		}

		// Add bucket read permissions if we need to read from the bucket
		readablePaths, err := iam.ReadableStatePaths(b.Cluster, nodeRole)
		if err != nil {
			return err
		}
		if len(readablePaths) != 0 {
			p, err := vfs.Context.BuildVfsPath(b.Cluster.Spec.ConfigStore.Base)
			if err != nil {
				return fmt.Errorf("cannot parse VFS path %q: %v", b.Cluster.Spec.ConfigStore.Base, err)
			}

			gcsPath, ok := p.(*vfs.GSPath)
			if !ok {
				klog.Warningf("unknown path, can't apply IAM policy: %q", p)
				continue
			}
			bucket := gcsPath.Bucket()
			if buckets.Has(bucket) {
				// Already marked as writeable; we can skip
				continue
			}
			buckets.Insert(bucket)

			nameForTask := strings.ToLower(string(role))

			klog.Warningf("adding bucket level read IAM to gs://%s for role %q", bucket, role)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the state/config store paths in the cluster spec for valid VFS syntax
2. Fix or remove the malformed path
3. Re-run kops update

When it happens

Trigger: Thrown at pkg/model/gcemodel/storageacl.go:188 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/60267e48d11a6264. Report an issue: GitHub.