kubernetes/kops · error

ConfigStore.Base path is not cluster readable: %v

Error message

ConfigStore.Base path is not cluster readable: %v

What it means

Cluster configuration must be stored on storage that nodes in the cluster can read (nodeup fetches config from VFS). run() throws this when the parsed ConfigStore.Base VFS path is not "cluster readable" — e.g. a memfs path or a path the cluster's nodes have no credentials to access.

Source

Thrown at upup/pkg/fi/cloudup/populate_cluster_spec.go:170

					etcdNames[m.Name] = m
					etcdInstanceGroups[instanceGroupName] = m
				}

				if (len(etcdNames) % 2) == 0 {
					// Not technically a requirement, but doesn't really make sense to allow
					return fmt.Errorf("there should be an odd number of control-plane-zones, for etcd's quorum.  Hint: Use --zones and --control-plane-zones to declare worker and control plane node zones separately")
				}
			}
		}
	}

	configBase, err := clientset.VFSContext().BuildVfsPath(cluster.Spec.ConfigStore.Base)
	if err != nil {
		return fmt.Errorf("error parsing ConfigStore.Base %q: %v", cluster.Spec.ConfigStore.Base, err)
	}
	if !vfs.IsClusterReadable(configBase) {
		// We could implement this approach, but it seems better to get all clouds using cluster-readable storage
		return fmt.Errorf("ConfigStore.Base path is not cluster readable: %v", cluster.Spec.ConfigStore.Base)
	}

	keyStore, err := clientset.KeyStore(cluster)
	if err != nil {
		return err
	}

	if cluster.Spec.ConfigStore.Keypairs == "" {
		hasVFSPath, ok := keyStore.(fi.HasVFSPath)
		if !ok {
			// We will mirror to ConfigBase
			basedir := configBase.Join("pki")
			cluster.Spec.ConfigStore.Keypairs = basedir.Path()
		} else if vfs.IsClusterReadable(hasVFSPath.VFSPath()) {
			vfsPath := hasVFSPath.VFSPath()
			cluster.Spec.ConfigStore.Keypairs = vfsPath.Path()
		} else {
			// We could implement this approach, but it seems better to get all clouds using cluster-readable storage

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set configStore.base to a cluster-readable location, e.g. s3://<bucket> with an IAM policy granting the node instance profiles read access.
2. Verify bucket permissions: nodes' IAM roles need s3:GetObject/ListBucket on the state bucket.
3. Avoid memfs:// or other local-only schemes; use the cloud object store matching your cloud provider.

Example fix

# before
configStore:
  base: memfs://clusters.example.com
# after
configStore:
  base: s3://my-kops-state-bucket/cluster.example.com

if !strings.HasPrefix(cluster.Spec.ConfigStore.Base, "s3://") && !strings.HasPrefix(cluster.Spec.ConfigStore.Base, "gs://") {
	return fmt.Errorf("state store must be a cloud object store readable by nodes")
}

When it happens

Trigger: PopulateClusterSpec with configStore.base set to a scheme that vfs.IsClusterReadable rejects, such as memfs://, or a VFS path backed by storage lacking node-readable permissions (e.g. a bucket with no IAM access from instances).

Common situations: Using an in-memory/test state store path in a real cluster; S3 bucket without a bucket policy granting access to cluster nodes (no IAM instance profile access); switching cloud providers but keeping a foreign state store URL.

Related errors

• error reading full cluster spec for %q: %v
• reading kops-channels manifest %s: %w
• error parsing ConfigStore.Base %q: %v
• error reading state store: %v
• error building ConfigStore.Base for cluster: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e5f224bea0198b16. Report an issue: GitHub.