kubernetes/kops · error

error checking GCS bucket IAM for gs://%s: %w

Error message

error checking GCS bucket IAM for gs://%s: %w

What it means

StorageBucketIAM.Find wraps a failed fetch of the bucket's V3 IAM policy (cloud.google.com/go/storage IAM().V3().Policy). kOps retrieves the current policy to check whether the desired member/role binding already exists; errors other than NotFound are wrapped with the bucket name.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/storagebucketiam.go:64

	return e.Name
}

func (e *StorageBucketIAM) Find(c *fi.CloudupContext) (*StorageBucketIAM, error) {
	ctx := context.TODO()

	cloud := c.T.Cloud.(gce.GCECloud)

	bucket := fi.ValueOf(e.Bucket)
	member := "serviceAccount:" + fi.ValueOf(e.MemberServiceAccount.Email)
	role := fi.ValueOf(e.Role)

	klog.V(2).Infof("Checking GCS bucket IAM for gs://%s for %s", bucket, member)
	policy, err := cloud.Storage().Bucket(bucket).IAM().V3().Policy(ctx)
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error checking GCS bucket IAM for gs://%s: %w", bucket, err)
	}

	changed := patchPolicy(policy, member, role)
	if changed {
		return nil, nil
	}

	actual := &StorageBucketIAM{}
	actual.Bucket = e.Bucket
	actual.MemberServiceAccount = e.MemberServiceAccount
	actual.Role = e.Role

	// Ignore "system" fields
	actual.Name = e.Name
	actual.Lifecycle = e.Lifecycle

	return actual, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error: 403 => grant roles/storage.admin or roles/storage.policyAdmin for the bucket's project; 404 => fix the bucket name / recreate the bucket.
2. Verify access manually: `gcloud storage buckets get-iam-policy gs://<bucket>` with the same credentials.
3. If the bucket is cross-project, add the kOps service account to the owning project with read-IAM rights.
4. Retry on transient 5xx/network errors.

cmd := exec.Command("gcloud", "storage", "buckets", "get-iam-policy", "gs://"+bucket)
if err := cmd.Run(); err != nil {
    return fmt.Errorf("cannot read IAM policy for gs://%s with current credentials: %w", bucket, err)
}

if err := kopsUpdate(); err != nil {
    if strings.Contains(err.Error(), "error checking GCS bucket IAM") {
        if strings.Contains(err.Error(), "403") {
            log.Print("grant roles/storage.admin or roles/storage.policyAdmin")
        } else if isTransient(err) {
            retryWithBackoff()
        }
    }
    return err
}

When it happens

Trigger: cloud.Storage().Bucket(bucket).IAM().V3().Policy(ctx) returns a non-nil, non-NotFound error during Find of a StorageBucketIAM task.

Common situations: kOps credentials lack storage.buckets.getIamPolicy (roles/storage.admin or roles/storage.policyAdmin); bucket missing on a path that surfaces a non-NotFound error (403 masking); cross-project bucket without grants; transient network/GCP 5xx.

Related errors

• error creating IAM policy for bucket gs://%s: %w
• error updating GCS bucket IAM for gs://%s: %v
• error checking GCS bucket ACL for gs://%s for %s: %v
• error setting GCS bucket ACL for gs://%s for %s as %s: %v
• error creating ServiceAccount %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ad2d4ae01363c543. Report an issue: GitHub.