kubernetes/kops · error

error downloading file %q: %v

Error message

error downloading file %q: %v

What it means

Any non-NotExist failure reading the source asset through VFS is wrapped as 'error downloading file <source>: <reason>'. This covers HTTP errors other than 404, TLS failures, DNS failures, and cloud-storage API errors while fetching the canonical asset.

Source

Thrown at pkg/assets/assetcopy/copyfile.go:114

		return fmt.Errorf("unable to transfer %q to %q: %v", source, target, err)
	}

	return nil
}

// transferFile downloads a file from the source location, validates the file matches the SHA,
// and uploads the file to the target location.
func transferFile(ctx context.Context, vfsContext *vfs.VFSContext, cluster *kops.Cluster, source string, target string, sha string) error {
	// TODO drop file to disk, as vfs reads file into memory.  We load kubelet into memory for instance.
	// TODO in s3 can we do a copy file ... would need to test

	data, err := vfsContext.ReadFile(source)
	if err != nil {
		if os.IsNotExist(err) {
			return fmt.Errorf("file not found %q: %v", source, err)
		}

		return fmt.Errorf("error downloading file %q: %v", source, err)
	}

	objectStore, err := buildVFSPath(target)
	if err != nil {
		return err
	}

	uploadVFS, err := vfsContext.BuildVfsPath(objectStore)
	if err != nil {
		return fmt.Errorf("error building path %q: %v", objectStore, err)
	}

	shaExtension, err := fileExtensionForSHA(sha)
	if err != nil {
		return err
	}

	shaTarget := objectStore + shaExtension

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error for the concrete cause (timeout vs 403 vs TLS).
2. Test the source URL with curl from the same machine/network to reproduce.
3. Fix credentials (aws configure / GOOGLE_APPLICATION_CREDENTIALS) if the source is private.
4. Retry after network/proxy issues are resolved; consider running from a host with egress to the asset host.

Example fix

// before
error downloading file "https://storage.googleapis.com/...": Get "...": dial tcp: lookup ...: no such host
// after (fix DNS/proxy, then)
export HTTPS_PROXY=http://proxy.corp:3128
kops get assets --copy ...

// Check basic reachability and auth before copying:
resp, err := http.Get(sourceURL) // or cloud SDK HEAD for private buckets
if err != nil { return err }
if resp.StatusCode >= 400 { return fmt.Errorf("%s -> %d", sourceURL, resp.StatusCode) }

err := transferFile(ctx, vfsContext, cluster, source, target, sha)
if err != nil && strings.Contains(err.Error(), "error downloading file") {
    // transient network/storage errors: retry with backoff
    return retryWithBackoff(3, time.Second, func() error {
        return transferFile(ctx, vfsContext, cluster, source, target, sha)
    })
}

When it happens

Trigger: vfsContext.ReadFile fails with e.g. 403 Forbidden, 500, connection timeout, bad TLS certificate, or S3/GCS API error when reading the canonical FileAsset URL during `kops get assets --copy`.

Common situations: Corporate proxy/firewall blocking storage.googleapis.com; expired or missing AWS/GCS credentials for a private source bucket; transient cloud-storage 5xx; hostname typos in a custom repository URL.

Related errors

• reading kops-channels manifest %s: %w
• ReadOnlyError
• error loading channel %q: %v
• unexpected kind for cluster, got %T, want kops.Cluster
• method ConfigBaseFor not supported in server-side client

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a07bbf93394c3ce2. Report an issue: GitHub.