kubernetes/kops · error

error downloading content from %q: %w

Error message

error downloading content from %q: %w

What it means

When the vfs path does support WriteToWithContext, the actual object download is performed by WriteToWithContext streaming into the writer. Any download failure (auth, network, object not found, aborted context) is wrapped with this message.

Source

Thrown at upup/pkg/fi/http.go:116

		algorithm = hash.Algorithm
	}
	hasher := algorithm.NewHasher()
	writer := io.MultiWriter(dest, hasher)

	switch u.Scheme {
	case "gs", "s3", "azureblob":
		// vfs resolves the bucket and signs the request with the ambient cloud credentials,
		// such as the instance identity.
		p, err := vfs.Context.BuildVfsPath(desturl)
		if err != nil {
			return nil, fmt.Errorf("building path for %q: %w", desturl, err)
		}
		cloudPath, ok := p.(vfs.WriterToWithContext)
		if !ok {
			return nil, fmt.Errorf("path type %T for %q does not implement WriteToWithContext", p, desturl)
		}
		if _, err := cloudPath.WriteToWithContext(ctx, writer); err != nil {
			return nil, fmt.Errorf("error downloading content from %q: %w", desturl, err)
		}
	default:
		reader, err := OpenURL(desturl)
		if err != nil {
			return nil, err
		}
		defer reader.Close()

		if _, err := io.Copy(writer, reader); err != nil {
			return nil, fmt.Errorf("error downloading HTTP content from %q: %v", desturl, err)
		}
	}

	actual := &hashing.Hash{
		Algorithm: algorithm,
		HashValue: hasher.Sum(nil),
	}
	if hash != nil && !actual.Equal(hash) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error for the provider status code
2. Verify the object exists at the exact URL in the bucket
3. Grant the ambient identity GetObject/objects.get permission on the bucket
4. Retry if the cause was transient (kops retries on next apply)

Example fix

// before: 403 from provider
aws iam attach-role-policy --role-name nodes --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
// after: re-run kops update cluster

// Pre-flight: confirm the object exists and is readable
_, err := s3Client.HeadObject(&s3.HeadObjectInput{Bucket: aws.String(b), Key: aws.String(k)})
if err != nil { return fmt.Errorf("object missing or unreadable: %w", err) }

var lastErr error
for attempt := 0; attempt < 3; attempt++ {
    _, err := fi.DownloadURL(ctx, assetURL, dest, nil)
    if err == nil { break }
    lastErr = err
    if !strings.Contains(err.Error(), "error downloading content") { return err }
    time.Sleep(backoff(attempt))
}
return lastErr

When it happens

Trigger: cloudPath.WriteToWithContext(ctx, writer) returns an error while streaming from gs/s3/azureblob: 403/404 from the provider, network interruption, or context cancellation.

Common situations: Missing/deleted object in the bucket; instance role lacking s3:GetObject / storage.objects.get; expired ambient credentials; transient network failures mid-download.

Related errors

• error loading channel %q: %v
• reading kops-channels manifest %s: %w
• error downloading file %q: %v
• error reading addon %q: %v
• error reading tag file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e2da12f107ae5efb. Report an issue: GitHub.