kubernetes/kops · error

checking if bucket was public: %w

Error message

checking if bucket was public: %w

What it means

When the discovery store is an S3 bucket and its HTTPS website URL equals kubeAPIServer.serviceAccountIssuer, kops relies on S3 static-website hosting and must know whether the bucket allows public reads. IsBucketPublic performs an S3 GetBucketPolicy/ACL check; any AWS API failure (permissions, connectivity) is wrapped in this error and fails the update.

Source

Thrown at pkg/model/issuerdiscovery.go:98

	var publicFileACL *bool

	discoveryStorePath := b.Cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore
	discoveryStore, err := vfs.Context.BuildVfsPath(discoveryStorePath)
	if err != nil {
		return fmt.Errorf("building VFS path for %q: %w", discoveryStorePath, err)
	}

	switch discoveryStore := discoveryStore.(type) {
	case *vfs.S3Path:
		discoveryStoreURL, err := discoveryStore.GetHTTPsUrl(b.Cluster.Spec.IsIPv6Only())
		if err != nil {
			return err
		}
		if discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {
			// Using Amazon S3 static website hosting requires public access
			isPublic, err := discoveryStore.IsBucketPublic(ctx)
			if err != nil {
				return fmt.Errorf("checking if bucket was public: %w", err)
			}
			if !isPublic {
				klog.Infof("serviceAccountIssuers bucket %q is not public; will use object ACL", discoveryStore.Bucket())
				publicFileACL = new(true)
			}
		} else {
			klog.Infof("using user managed serviceAccountIssuers")
		}
	case *vfs.GSPath:
		discoveryStoreURL, err := discoveryStore.GetHTTPsUrl()
		if err != nil {
			return err
		}
		if discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {
			// Using Google Cloud Storage requires public access
			isPublic, err := discoveryStore.IsBucketPublic(ctx)
			if err != nil {
				return fmt.Errorf("checking if bucket was public: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the kops credentials s3:GetBucketPolicy, s3:GetBucketAcl and s3:GetBucketPublicAccessBlock on the discovery bucket.
2. Verify network access to the bucket's S3 endpoint (no proxy/firewall blocking) and that the bucket exists in the resolved region.
3. Confirm the bucket is in the account kops is operating against; mismatched accounts commonly cause AccessDenied here.
4. As a workaround, set kubeAPIServer.serviceAccountIssuer to a URL different from the bucket website URL so kops skips the publicity check (you then manage serving yourself).

Example fix

// before: IAM policy without bucket-policy read
{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject"],"Resource":"arn:aws:s3:::oidc-bucket/*"}
// after
{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject","s3:GetBucketPolicy","s3:GetBucketAcl"],"Resource":["arn:aws:s3:::oidc-bucket","arn:aws:s3:::oidc-bucket/*"]}

// Pre-check bucket publicity and IAM permissions before running update:
out, err := exec.Command("aws", "s3api", "get-bucket-policy-status",
    "--bucket", bucket).CombinedOutput()
if err != nil {
    return fmt.Errorf("cannot inspect bucket %s public status (check s3:GetBucketPolicy perms): %s: %v", bucket, out, err)
}

err := runKopsUpdate(ctx)
if err != nil && strings.Contains(err.Error(), "checking if bucket was public") {
    // fall back: inspect bucket policy manually, or unset the issuer match to skip the check
    log.Printf("S3 publicity check failed; verify IAM GetBucketPolicy perms: %v", err)
}

When it happens

Trigger: `kops update cluster` on AWS with discoveryStore pointing at an S3 bucket whose website URL matches the configured serviceAccountIssuer, while the S3 API call to inspect bucket policy/publicity fails (missing s3:GetBucketPolicy/s3:GetBucketAcl permission, blocked network, or bucket in another account).

Common situations: IAM user/role lacking GetBucketPolicy on the discovery bucket, bucket owned by a different AWS account, SCP denying public-access inspection (BlockPublicPolicy), or corporate proxy cutting off S3 endpoints.

Related errors

• error listing %s: %v
• failed to get bucket details for %q: %w
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• getting location for bucket %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ebf2438a31439044. Report an issue: GitHub.