kubernetes/kops · error

error querying GCS object ACL for gs://%s/%s for %s: %v

Error message

error querying GCS object ACL for gs://%s/%s for %s: %v

What it means

Wrapped error from StorageObjectAcl.Find when listing the GCS object's ACL entries fails with a non-404 error. Bucket, object path, and entity are included; typical causes are missing storage.objects.getIamPolicy/acl permission or a nonexistent bucket/object path.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:62

func (e *StorageObjectAcl) CompareWithID() *string {
	return e.Name
}

func (e *StorageObjectAcl) Find(c *fi.CloudupContext) (*StorageObjectAcl, error) {
	cloud := c.T.Cloud.(gce.GCECloud)

	bucket := fi.ValueOf(e.Bucket)
	object := fi.ValueOf(e.Object)
	entity := fi.ValueOf(e.Entity)

	klog.V(2).Infof("Checking GCS object ACL for gs://%s/%s for %s", bucket, object, entity)
	rules, err := cloud.Storage().Bucket(bucket).Object(object).ACL().List(context.TODO())
	if err != nil {
		if gce.IsNotFound(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error querying GCS object ACL for gs://%s/%s for %s: %v", bucket, object, entity, err)
	}

	for _, r := range rules {
		if string(r.Entity) != entity {
			continue
		}

		foundEntity := string(r.Entity)
		foundRole := string(r.Role)

		actual := &StorageObjectAcl{}
		actual.Name = e.Name
		actual.Bucket = e.Bucket
		actual.Object = e.Object
		actual.Entity = &foundEntity

		actual.Role = &foundRole

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the bucket and object path in the spec are correct and exist
2. Grant the service account permission to read object ACLs on the bucket
3. Inspect the wrapped error and retry if transient

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/56204191b2658b3f. Report an issue: GitHub.