kubernetes/kops · error

error building secret store path: %v

Error message

error building secret store path: %v

What it means

When running in VFS mode (no config server), nodeup builds the SecretStore from the path in nodeupConfig.ConfigStore.Secrets via vfs.Context.BuildVfsPath. This error means the secrets location string is not a valid/constructible VFS path (unknown scheme, malformed URL, unsupported backend). Run aborts before the secret store can be wired into the model context.

Source

Thrown at upup/pkg/fi/nodeup/command.go:220

		Cloud:        cloud,
		Architecture: architecture,
		Assets:       assetStore,
		ConfigBase:   configBase,
		Distribution: distribution,
		BootConfig:   &bootConfig,
		NodeupConfig: &nodeupConfig,
	}

	var secretStore fi.SecretStoreReader
	var keyStore fi.KeystoreReader
	switch {
	case nodeConfig != nil:
		modelContext.SecretStore = configserver.NewSecretStore(nodeConfig.NodeSecrets)
	case nodeupConfig.ConfigStore != nil && nodeupConfig.ConfigStore.Secrets != "":
		klog.Infof("Building SecretStore at %q", nodeupConfig.ConfigStore.Secrets)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Secrets)
		if err != nil {
			return fmt.Errorf("error building secret store path: %v", err)
		}

		secretStore = secrets.NewVFSSecretStoreReader(p)
		modelContext.SecretStore = secretStore
	default:
		return fmt.Errorf("SecretStore not set")
	}

	if nodeConfig != nil {
		modelContext.KeyStore = configserver.NewKeyStore()
	} else if nodeupConfig.ConfigStore.Keypairs != "" {
		klog.Infof("Building KeyStore at %q", nodeupConfig.ConfigStore.Keypairs)
		p, err := vfs.Context.BuildVfsPath(nodeupConfig.ConfigStore.Keypairs)
		if err != nil {
			return fmt.Errorf("error building key store path: %v", err)
		}

		modelContext.KeyStore = fi.NewVFSKeystoreReader(p)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix ConfigStore.Secrets in the cluster spec / nodeupconfig.yaml to a valid VFS path with a supported scheme (e.g. s3://bucket/cluster/secrets, gs://bucket/secrets, or a filesystem path).
2. Re-run 'kops update cluster --yes' so nodeupconfig.yaml is regenerated from a corrected cluster spec instead of editing the file directly.
3. Verify the VFS backend for the scheme is compiled in / credentials are configured (note: BuildVfsPath failure is parse-level, but bad env can accompany scheme mistakes).
4. If migrating backends, update all ConfigStore fields (secrets, keypairs) consistently via 'kops editor' / cluster spec rather than partial edits.

Example fix

// before (nodeupconfig.yaml)
configStore:
  secrets: s:/bucket/cluster/secrets
// after
configStore:
  secrets: s3://bucket/cluster/secrets

// Ensure the secrets path is a parseable VFS path before invoking nodeup
if _, err := vfs.Context.BuildVfsPath(cfg.ConfigStore.Secrets); err != nil {
    return fmt.Errorf("invalid ConfigStore.Secrets path %q: %w", cfg.ConfigStore.Secrets, err)
}

err := cmd.Run(out)
if err != nil && strings.Contains(err.Error(), "error building secret store path") {
    // fix the scheme/URI in the cluster spec and re-apply
}

When it happens

Trigger: Running NodeUpCommand.Run() with nodeConfig == nil and nodeupConfig.ConfigStore.Secrets set to a string BuildVfsPath cannot parse — e.g. a typo'd scheme like 's:/bucket/secrets', an unsupported protocol, or shell-mangled characters in the path.

Common situations: Hand-edited nodeupconfig.yaml with a malformed secrets path; migrating between state-store backends (S3/GCS/OSS) and leaving a stale or invalid URI; quoting/escaping problems introduced during templating of the config.

Related errors

• error building key store path: %v
• parsing path for kops-channels manifest %s: %w
• reading kops-channels manifest %s: %w
• error parsing path for etcd manifest %s: %v
• error reading etcd manifest %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/41c24cd2ccd9ba9a. Report an issue: GitHub.