kubernetes/kops · error

error fetching default ServiceAccount: %w

Error message

error fetching default ServiceAccount: %w

What it means

Fetching the GCE project's default service account from the cloud API failed while configuring storage bucket ACLs; a GCE API or permission error, before any ACL task is built.

Source

Thrown at pkg/model/gcemodel/storageacl.go:55

	Cloud     gce.GCECloud
	Lifecycle fi.Lifecycle
}

var _ fi.CloudupModelBuilder = &StorageAclBuilder{}

// Build creates the tasks that set up storage acls

func (b *StorageAclBuilder) Build(c *fi.CloudupModelBuilderContext) error {
	if featureflag.GoogleCloudBucketACL.Enabled() {
		if b.Cluster.Spec.CloudProvider.GCE.ServiceAccount == "" {
			return fmt.Errorf("featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount")
		}

		klog.Warningf("featureflag GoogleCloudBucketACL is no longer recommended; use per-instancegroup GCEServiceAccounts instead")

		gceDefaultServiceAccount, err := b.Cloud.ServiceAccount()
		if err != nil {
			return fmt.Errorf("error fetching default ServiceAccount: %w", err)
		}

		clusterPath := b.Cluster.Spec.ConfigStore.Base
		p, err := vfs.Context.BuildVfsPath(clusterPath)
		if err != nil {
			return fmt.Errorf("cannot parse cluster path %q: %w", clusterPath, err)
		}

		if p, ok := p.(*vfs.GSPath); ok {
			// It's not ideal that we have to do this at the bucket level,
			// but GCS doesn't seem to have a way to do subtrees (like AWS IAM does)
			// Note this permission only lets us list objects, not read them
			c.AddTask(&gcetasks.StorageBucketAcl{
				Name:      s("serviceaccount-statestore-list"),
				Lifecycle: b.Lifecycle,
				Bucket:    s(p.Bucket()),
				Entity:    s("user-" + gceDefaultServiceAccount),
				Role:      s("READER"),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the credentials can read the project's service accounts
2. Verify the GCP project configuration
3. Retry after resolving API access

When it happens

Trigger: Thrown at pkg/model/gcemodel/storageacl.go:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ddf04881973e573b. Report an issue: GitHub.