kubernetes/kops · error

error from acl provider %q: %w

Error message

error from acl provider %q: %w

What it means

This is the generic wrapper in the ACL strategy registry: each registered ACL strategy (GCE, AWS, etc.) is tried in turn, and if a strategy's GetACL returns an error it is wrapped as `error from acl provider %q: %w` naming the strategy key. It signals that a specific cloud ACL provider failed, with the underlying provider error preserved via %w.

Source

Thrown at util/pkg/vfs/acls/plugins.go:41

	"k8s.io/kops/pkg/apis/kops"
	"k8s.io/kops/util/pkg/vfs"
)

var (
	strategies      map[string]ACLStrategy
	strategiesMutex sync.Mutex
)

// GetACL returns the ACL for the vfs.Path, by consulting all registered strategies
func GetACL(ctx context.Context, p vfs.Path, cluster *kops.Cluster) (vfs.ACL, error) {
	strategiesMutex.Lock()
	defer strategiesMutex.Unlock()

	for k, strategy := range strategies {
		acl, err := strategy.GetACL(ctx, p, cluster)
		if err != nil {
			return nil, fmt.Errorf("error from acl provider %q: %w", k, err)
		}
		if acl != nil {
			return acl, nil
		}
	}
	return nil, nil
}

// RegisterPlugin adds the strategy to the registered strategies
func RegisterPlugin(key string, strategy ACLStrategy) {
	strategiesMutex.Lock()
	defer strategiesMutex.Unlock()

	if strategies == nil {
		strategies = make(map[string]ACLStrategy)
	}

	strategies[key] = strategy

View on GitHub (pinned to 4c8573c808)

Solutions

1. Unwrap the error chain (%w) with errors.Unwrap or errors.As to reach the underlying cloud-provider error and fix that cause.
2. Check credentials/IAM for the cloud provider named in the %q placeholder.
3. If one provider is consistently failing and irrelevant to your storage backend, ensure only the appropriate ACL strategy is registered/compiled in.
4. Retry if the wrapped cause is transient (network, rate limit).

Example fix

// before
acl, err := vfs.GetACL(ctx, p, cluster)
if err != nil { return err }
// after
acl, err := vfs.GetACL(ctx, p, cluster)
if err != nil {
    var target *googleapi.Error
    if errors.As(err, &target) && target.Code == 403 { /* fix IAM */ }
    return fmt.Errorf("GetACL: %w", err)
}

// Pre-flight: ensure the cloud credentials for your backend work before ACL calls
creds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if creds == "" { return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS not set") }
if _, err := os.Stat(creds); err != nil { return err }

func unwrapProvider(err error) (provider string, cause error) {
    provider := "unknown"
    for err != nil {
        if u, ok := err.(interface{ Unwrap() error }); ok {
            cause = u.Unwrap()
            if cause != nil && !strings.Contains(cause.Error(), "error from acl provider") { break }
            err = cause
            continue
        }
        break
    }
    return provider, err
}

acl, err := GetACL(ctx, p, cluster)
if err != nil {
    if strings.Contains(err.Error(), "error from acl provider") {
        cause := errors.Unwrap(err) // inspect the provider-specific cause
        log.Printf("acl provider failed: %v (cause: %v)", err, cause)
    }
    return err
}

When it happens

Trigger: Any call to the ACL GetACL dispatcher where an individual registered strategy (e.g. the GCS strategy of error 3800) returns a non-nil error — e.g. unqueryable bucket, cloud API auth failure, or malformed cluster/path input handed to the strategy.

Common situations: Chained failure surfaces: the real cause (403 from GCS, missing credentials) arrives wrapped with the provider name prefixed; developers see this line and must unwrap to find the cloud-specific cause.

Related errors

• unable to transfer %q to %q: %v
• the %q path is intended for use in tests
• the %q path does not support public ACL
• error building acl for secret %q for mirror: %v
• expected acl to be S3Acl, was %T

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c0b6ec54d762b86. Report an issue: GitHub.