kubernetes/kops · error

error parsing locationStore=%q: %w

Error message

error parsing locationStore=%q: %w

What it means

BuildOptions resolves ServiceAccountIssuerDiscovery.DiscoveryStore into a VFS path to derive the service account issuer URL. If vfs.Context.BuildVfsPath cannot parse the store location string, the error is wrapped as 'error parsing locationStore=...'.

Source

Thrown at pkg/model/components/discovery.go:56

	if clusterSpec.KubeAPIServer == nil {
		clusterSpec.KubeAPIServer = &kops.KubeAPIServerConfig{}
	}

	kubeAPIServer := clusterSpec.KubeAPIServer

	if len(kubeAPIServer.APIAudiences) == 0 {
		kubeAPIServer.APIAudiences = []string{"kubernetes.svc.default"}
	}

	if kubeAPIServer.ServiceAccountIssuer == nil {
		said := clusterSpec.ServiceAccountIssuerDiscovery
		var serviceAccountIssuer string
		if said != nil && said.DiscoveryStore != "" {
			store := said.DiscoveryStore
			base, err := vfs.Context.BuildVfsPath(store)
			if err != nil {
				return fmt.Errorf("error parsing locationStore=%q: %w", store, err)
			}
			switch base := base.(type) {
			case *vfs.S3Path:
				serviceAccountIssuer, err = base.GetHTTPsUrl(clusterSpec.IsIPv6Only())
				if err != nil {
					return err
				}
			case *vfs.GSPath:
				serviceAccountIssuer, err = base.GetHTTPsUrl()
				if err != nil {
					return err
				}
			case *vfs.MemFSPath:
				if !base.IsClusterReadable() {
					// If this _is_ a test, we should call MarkClusterReadable
					return fmt.Errorf("locationStore=%q is only supported in tests", store)
				}
				serviceAccountIssuer = strings.Replace(base.Path(), "memfs://", "https://", 1)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the discoveryStore value in the cluster spec to a valid vfs path (e.g. s3://bucket/path)
2. Check the wrapped inner error (%w) for the exact parse failure and fix that part of the URL
3. Use kops toolbox to validate the cluster spec before applying

Example fix

// before
serviceAccountIssuerDiscovery:
  discoveryStore: "s3:/bad bucket/path"
// after
serviceAccountIssuerDiscovery:
  discoveryStore: "s3://my-bucket/sa-discovery"

u, err := url.Parse(discoveryStore)
if err != nil || u.Scheme == "" {
    return fmt.Errorf("discoveryStore must be a valid vfs path, got %q", discoveryStore)
}

null

if err := b.BuildOptions(...); err != nil {
    var parseErr error
    if strings.Contains(err.Error(), "error parsing locationStore=") {
        // fix discoveryStore in cluster spec and retry
    }
    return err
}

When it happens

Trigger: Setting cluster.spec.serviceAccountIssuerDiscovery.discoveryStore to a malformed or unsupported location (bad scheme, invalid S3 URL) before/while running kops build options (e.g. during cluster update).

Common situations: Typo in the store URI scheme; using a scheme not compiled into VFS; hand-edited cluster spec with invalid URL; region/bucket characters that fail URL parsing.

Related errors

• error parsing ConfigStore.Base %q: %v
• locationStore=%q is of unexpected type %T
• cannot parse ConfigBase %q: %w
• no keypair ID for %q
• error parsing path for etcd manifest %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/38c0640c706db5c3. Report an issue: GitHub.