kubernetes/kops · error

error during chmod of %q: %w

Error message

error during chmod of %q: %w

What it means

After writing the temp file, WriteFile applies the *SSHAcl Mode via sftpClient.Chmod. If the chmod fails on the SFTP server, the error is wrapped with this message naming the temp file path. This ensures the final renamed file has the intended permissions (e.g. 0600 for secrets).

Source

Thrown at util/pkg/vfs/sshfs.go:227

		}
	}()
	if _, err := io.Copy(f, data); err != nil {
		return fmt.Errorf("writing to sftp temp file: %w", err)
	}

	shouldClose = false
	if err := f.Close(); err != nil {
		return err
	}

	if acl != nil {
		sshACL, ok := acl.(*SSHAcl)
		if !ok {
			return fmt.Errorf("unexpected acl type %T", acl)
		} else {
			err = sftpClient.Chmod(tempfile, sshACL.Mode)
			if err != nil {
				return fmt.Errorf("error during chmod of %q: %w", tempfile, err)
			}
		}
	}

	// posix rename will replace the destination (normal sftp rename does not)
	usePosixRename := true
	if usePosixRename {
		// posix rename fails if destination exists, try to delete just in case
		if err := sftpClient.Remove(p.path); err != nil {
			if os.IsNotExist(err) {
				// expected when file does not exist already
			} else {
				return fmt.Errorf("removing destination sftp file %q before rename: %w", p.path, err)
			}
		}
		if err := sftpClient.Rename(tempfile, p.path); err != nil {
			return fmt.Errorf("renaming sftp file %q -> %q (with posix rename): %w", tempfile, p.path, err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. SSH to the host and set the mode manually, then retry the overall operation: `chmod <mode> <dir>/.tmp-*` or fix the server config.
2. Check sshd_config / SFTP subsystem configuration (internal-sftp with -u umask) and allow CHMOD or set the desired umask.
3. If the ACL mode is not essential, pass acl=nil to skip the chmod step.
4. Retry if the wrapped error is transient (connection reset).

Example fix

// before: sshd denies chmod for restricted sftp user
Subsystem sftp internal-sftp -u 077 -d /srv
// after: allow ownership-preserving perms
Subsystem sftp internal-sftp -u 022 -d /srv

// confirm the SFTP user can chmod in the target dir
out := sshRun(host, fmt.Sprintf("touch %s/.permtest && chmod 600 %s/.permtest && rm %s/.permtest && echo chmod-ok", dir, dir, dir))

err := path.WriteFile(ctx, data, acl)
if err != nil && strings.Contains(err.Error(), "error during chmod") {
    // fall back: fix remote perms out-of-band, or retry with nil acl
    sshRun(host, fmt.Sprintf("chmod %o %s/.tmp-*", 0o600, dir))
    return path.WriteFile(ctx, data, nil)
}

When it happens

Trigger: sftpClient.Chmod(tempfile, sshACL.Mode) returns an error: the SFTP user owns the file but the server rejects chmod (chroot/subsystem restrictions), or the connection dropped between Create and Chmod.

Common situations: SFTP servers configured with a fixed umask or denying CHMOD requests; restrictive sshd Subsystem configs on bastions; permission enforcement (e.g. restricted SFTP user) on managed hosts.

Related errors

• error creating directory %q over sftp: %w
• removing destination sftp file %q before rename: %w
• error creating sftp client: %w
• error creating sftp client (in new-session): %w
• error creating sftp client (at stdin pipe): %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/92184f9f3a8ff1bc. Report an issue: GitHub.