kubernetes/kops · error

error building acl for secret %q for mirror: %v

Error message

error building acl for secret %q for mirror: %v

What it means

Before writing each mirrored secret, MirrorTo computes the destination ACL with acls.GetACL(ctx, p, c.cluster). If ACL computation fails — e.g. the cluster spec lacks the fields needed to derive permissions for the target VFS path — the error is wrapped as 'error building acl for secret %q for mirror'. The secret is not written in this case.

Source

Thrown at upup/pkg/fi/secrets/vfs_secretstore.go:76

	if err != nil {
		return fmt.Errorf("error listing secrets for mirror: %v", err)
	}

	for _, name := range secrets {
		secret, err := c.FindSecret(name)
		if err != nil {
			return fmt.Errorf("error reading secret %q for mirror: %v", name, err)
		}

		if secret == nil {
			return fmt.Errorf("unable to find secret %q for mirror", name)
		}

		p := BuildVfsSecretPath(basedir, name)

		acl, err := acls.GetACL(ctx, p, c.cluster)
		if err != nil {
			return fmt.Errorf("error building acl for secret %q for mirror: %v", name, err)
		}

		klog.Infof("mirroring secret %s -> %s", name, p)

		err = createSecret(ctx, secret, p, acl, true)
		if err != nil {
			return fmt.Errorf("error writing secret %q for mirror: %v", name, err)
		}
	}

	return nil
}

// DeleteSecret implements fi.SecretStore DeleteSecret
func (c *VFSSecretStore) DeleteSecret(name string) error {
	ctx := context.TODO()

	p := c.buildSecretPath(name)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped cause; fix the cluster spec field it complains about (e.g. `kops edit cluster`)
2. Verify the destination VFS path scheme is supported by the ACL builder
3. Re-run `kops update` / upgrade the cluster spec so required identity fields are present
4. Mirror to a path within the same state store backend where ACLs are derivable

// Derive the ACL yourself before mirroring to surface spec problems early
p := secrets.BuildVfsSecretPath(target, "probe")
if _, err := acls.GetACL(ctx, p, cluster); err != nil {
    return fmt.Errorf("cluster spec cannot produce ACLs for target: %v", err)
}

When it happens

Trigger: GetACL cannot determine permissions for the destination path: cluster field missing/invalid in the kops.Cluster object, unsupported VFS path scheme for ACL derivation, or an error fetching cloud identity info (e.g. AWS account lookups) required to build S3 ACLs.

Common situations: Mirroring to a state store in a different account/region where the cluster spec has no matching config, kops version changes in ACL schema, incomplete cluster spec loaded from an old state store.

Related errors

• error listing secrets for mirror: %v
• error reading secret %q for mirror: %v
• unable to find secret %q for mirror
• error writing secret %q for mirror: %v
• error loading secret %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a126f5ccc00a3fb8. Report an issue: GitHub.