kubernetes/kops · error

error setting GCS object ACL for gs://%s/%s for %s as %s: %v

Error message

error setting GCS object ACL for gs://%s/%s for %s as %s: %v

What it means

Wrapped error from StorageObjectAcl.RenderGCE when the GCS ACL Set call fails while granting the entity its role on the object. Bucket, object, entity, and role are all included in the message; common causes are an invalid entity string or missing storage.objects.setIamPolicy/acl permission.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:121

	}
	return nil
}

func (_ *StorageObjectAcl) RenderGCE(t *gce.GCEAPITarget, a, e, changes *StorageObjectAcl) error {
	bucket := fi.ValueOf(e.Bucket)
	object := fi.ValueOf(e.Object)
	entity := fi.ValueOf(e.Entity)
	role := fi.ValueOf(e.Role)

	if a == nil {
		klog.V(2).Infof("Creating GCS object ACL for gs://%s/%s for %s as %s", bucket, object, entity, role)
	} else {
		klog.V(2).Infof("Updating GCS object ACL for gs://%s/%s for %s as %s", bucket, object, entity, role)
	}

	err := t.Cloud.Storage().Bucket(bucket).Object(object).ACL().Set(context.TODO(), storage.ACLEntity(entity), storage.ACLRole(role))
	if err != nil {
		return fmt.Errorf("error setting GCS object ACL for gs://%s/%s for %s as %s: %v", bucket, object, entity, role, err)
	}

	return nil
}

// terraformStorageObjectAcl is the model for a terraform google_storage_object_acl rule
type terraformStorageObjectAcl struct {
	Bucket     string   `cty:"bucket"`
	Object     string   `cty:"object"`
	RoleEntity []string `cty:"role_entity"`
}

func (_ *StorageObjectAcl) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *StorageObjectAcl) error {
	var roleEntities []string
	roleEntities = append(roleEntities, fi.ValueOf(e.Role)+":"+fi.ValueOf(e.Name))
	tf := &terraformStorageObjectAcl{
		Bucket:     fi.ValueOf(e.Bucket),
		Object:     fi.ValueOf(e.Object),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error for the GCS rejection reason
2. Verify the entity format (e.g. serviceAccount:..., group:...) and that the bucket/object exist
3. Grant ACL-write permission on the bucket and re-run

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3bce7af8c157a384. Report an issue: GitHub.