kubernetes/kops · error

error building GCS client: %v

Error message

error building GCS client: %v

What it means

getGCSClient calls storage.NewClient (cloud.google.com/go/storage) with full-control scope and wraps any failure as "error building GCS client". This means Application Default Credentials / the GCS client could not be constructed at all, before any request was made.

Source

Thrown at util/pkg/vfs/context.go:527

	gcsPath := NewGSPath(c, bucket, u.Path)
	return gcsPath, nil
}

// getGCSClient returns the google cloud storage client, caching it for future calls
func (c *VFSContext) getGCSClient(ctx context.Context) (*storage.Client, error) {
	c.mutex.Lock()
	defer c.mutex.Unlock()

	if c.cachedGCSClient != nil {
		return c.cachedGCSClient, nil
	}

	// TODO: Should we fall back to read-only?
	scope := storage.ScopeFullControl

	gcsClient, err := storage.NewClient(ctx, option.WithScopes(scope))
	if err != nil {
		return nil, fmt.Errorf("error building GCS client: %v", err)
	}

	c.cachedGCSClient = gcsClient
	return gcsClient, nil
}

// getSwiftClient returns the openstack switch client, caching it for future calls
func (c *VFSContext) getSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {
	c.mutex.Lock()
	defer c.mutex.Unlock()

	if c.swiftClient != nil {
		return c.swiftClient, nil
	}

	swiftClient, err := NewSwiftClient(ctx)
	if err != nil {
		return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key with Storage Object Admin on the state bucket
2. Run the workload on GCE/GKE with the cloud-platform / full-control scope enabled, or configure workload identity
3. Test credentials independently: `gcloud auth application-default login` or `gsutil ls gs://<bucket>` with the same identity
4. Check network egress to oauth2.googleapis.com / storage.googleapis.com and any proxy configuration
5. Verify the credentials file has not expired (key deleted/rotated in GCP console)

Example fix

// before
export KOPS_STATE_STORE=gs://my-bucket
kops create cluster ...   # no credentials available
// after
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json
export KOPS_STATE_STORE=gs://my-bucket
kops create cluster ...

if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" { if _, err := google.FindDefaultCredentials(context.Background(), storage.ScopeFullControl); err != nil { return fmt.Errorf("no GCP credentials available: %v", err) } }

client, err := getGCSClient(ctx); if err != nil { if strings.Contains(err.Error(), "error building GCS client") { // check creds/network before retrying: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS } return err }

When it happens

Trigger: storage.NewClient failing due to: no Application Default Credentials found (GOOGLE_APPLICATION_CREDENTIALS unset and metadata server unavailable), unreadable/invalid credentials file, missing required IAM roles for the scope, or network failure reaching the OAuth token endpoint.

Common situations: Running kops on a non-GCE machine without GOOGLE_APPLICATION_CREDENTIALS; service-account JSON key file deleted or malformed; workload identity not configured on the GKE node; corporate firewall blocking oauth2.googleapis.com.

Related errors

• DIGITALOCEAN_ACCESS_TOKEN is required
• getting AWS credentials: %w
• creating identity: %w
• error getting AWS account ID: %v
• error building openstack authenticated client: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d2d8c3bf8b3caede. Report an issue: GitHub.