kubernetes/kops · error

error setting GCS bucket ACL for gs://%s for %s as %s: %v

Error message

error setting GCS bucket ACL for gs://%s for %s as %s: %v

What it means

StorageBucketAcl.RenderGCE wraps a failed cloud.google.com/go/storage ACL Set call. kOps calls Set to create or update an ACL rule (entity/role pair) on the GCS bucket; any API failure is wrapped with bucket, entity, and role.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/storagebucketacl.go:114

		return fi.RequiredField("Entity")
	}
	return nil
}

func (_ *StorageBucketAcl) RenderGCE(t *gce.GCEAPITarget, a, e, changes *StorageBucketAcl) error {
	bucket := fi.ValueOf(e.Bucket)
	entity := fi.ValueOf(e.Entity)
	role := fi.ValueOf(e.Role)

	if a == nil {
		klog.V(2).Infof("Creating GCS bucket ACL for gs://%s for %s as %s", bucket, entity, role)
	} else {
		klog.V(2).Infof("Updating GCS bucket ACL for gs://%s for %s as %s", bucket, entity, role)
	}

	err := t.Cloud.Storage().Bucket(bucket).ACL().Set(context.TODO(), storage.ACLEntity(entity), storage.ACLRole(role))
	if err != nil {
		return fmt.Errorf("error setting GCS bucket ACL for gs://%s for %s as %s: %v", bucket, entity, role, err)
	}

	return nil
}

// terraformStorageBucketAcl is the model for a terraform google_storage_bucket_acl rule
type terraformStorageBucketAcl struct {
	Bucket     string   `cty:"bucket"`
	RoleEntity []string `cty:"role_entity"`
}

func (_ *StorageBucketAcl) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *StorageBucketAcl) error {
	var roleEntities []string
	roleEntities = append(roleEntities, fi.ValueOf(e.Role)+":"+fi.ValueOf(e.Entity))
	tf := &terraformStorageBucketAcl{
		Bucket:     fi.ValueOf(e.Bucket),
		RoleEntity: roleEntities,
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error: 403 => grant roles/storage.admin (or storage.buckets.setIamPolicy + legacy ACL write) on the bucket; 404 => bucket missing, recreate it before the ACL task runs.
2. Validate the Entity format in the cluster spec (e.g. `user:email@domain` style values) — malformed entities are rejected.
3. Check bucket-level constraints (public access prevention for allUsers/allAuthenticatedUsers entities) and org policy restrictions.
4. Retry for transient 429/5xx; ensure the bucket task is ordered before the ACL task.

Example fix

// before (invalid entity format)
Entity: fi.String("jane@example.com")
// after
Entity: fi.String("user-jane@example.com")

validEntity := regexp.MustCompile(`^(allUsers|allAuthenticatedUsers|(user|group|domain|serviceAccount|project)-.+)`)
if !validEntity.MatchString(fi.ValueOf(e.Entity)) {
    return fmt.Errorf("invalid ACL entity %q (expected e.g. user-email@x or group-...)", fi.ValueOf(e.Entity))
}
// also check write permission
if !hasPerm("storage.buckets.setIamPolicy") { return fmt.Errorf("missing storage.buckets.setIamPolicy") }

func validACLEntity(e string) bool {
    return regexp.MustCompile(`^(allUsers|allAuthenticatedUsers|(user|group|domain|serviceAccount|project)-.+)`).MatchString(e)
}

if err := kopsUpdate(); err != nil {
    if strings.Contains(err.Error(), "error setting GCS bucket ACL") {
        if strings.Contains(err.Error(), "403") {
            log.Print("grant roles/storage.admin / storage.buckets.setIamPolicy")
        } else if strings.Contains(err.Error(), "404") {
            log.Print("bucket missing; ensure bucket task runs before ACL task")
        }
    }
    return err
}

When it happens

Trigger: t.Cloud.Storage().Bucket(bucket).ACL().Set(ctx, entity, role) returns an error during RenderGCE of a StorageBucketAcl task (create or update path).

Common situations: kOps credentials lack storage.buckets.setIamPolicy / legacy bucket ACL write permission (roles/storage.legacyBucketOwner or storage.admin); the bucket was deleted or renamed between Find and apply; invalid entity string format (must be like `user-email`, `group-...`, `allAuthenticatedUsers`); bucket is public-access-prevention / org-policy restricted; transient 5xx.

Related errors

• error checking GCS bucket ACL for gs://%s for %s: %v
• error checking GCS bucket IAM for gs://%s: %w
• error creating IAM policy for bucket gs://%s: %w
• error updating GCS bucket IAM for gs://%s: %v
• error querying bucket %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/594f8ede76058557. Report an issue: GitHub.