kubernetes/kops · error

error writing configuration file %s: %v

Error message

error writing configuration file %s: %v

What it means

writeConfig calls configPath.WriteFile to persist the configuration object to the VFS state store. Any write error that is not the handled 'create but already exists' case is wrapped with this message. It indicates the state-store rejected the write.

Source

Thrown at pkg/client/simple/vfsclientset/commonvfs.go:174

	}

	acl, err := acls.GetACL(ctx, configPath, cluster)
	if err != nil {
		return err
	}

	rs := bytes.NewReader(data)
	if create {
		err = configPath.CreateFile(ctx, rs, acl)
	} else {
		err = configPath.WriteFile(ctx, rs, acl)
	}
	if err != nil {
		if create && os.IsExist(err) {
			klog.Warningf("failed to create file as already exists: %v", configPath)
			return err
		}
		return fmt.Errorf("error writing configuration file %s: %v", configPath, err)
	}
	return nil
}

func (c *VFSClientBase) update(ctx context.Context, cluster *kops.Cluster, i runtime.Object) error {
	objectMeta, err := meta.Accessor(i)
	if err != nil {
		return err
	}

	if c.validate != nil {
		err = c.validate(i)
		if err != nil {
			return err
		}
	}

	creationTimestamp := objectMeta.GetCreationTimestamp()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v error to identify the backend cause and fix permissions/connectivity.
2. If 'create as already exists' is intended, handle the returned sentinel error rather than treating it as a storage fault.
3. Ensure the VFS backend allows conditional writes for create operations.
4. Retry once concurrent writers are eliminated.

Example fix

// before
IAM policy with only s3:GetObject
// after
{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::my-state-bucket/*"}

if _, err := store.ReadFile(ctx, dir); err != nil {
    return fmt.Errorf("cannot access state store before write: %w", err)
}
if err := checkIAMWritePermission(ctx, bucket); err != nil {
    return err
}

if err := client.Create(ctx, obj); err != nil {
    if os.IsExist(err) {
        // already exists: load and update instead
        return client.Update(ctx, obj)
    }
    if isTransient(err) {
        return retryWithBackoff(func() error { return client.Create(ctx, obj) })
    }
    return err
}

When it happens

Trigger: Create or Update calls writeConfig and vfs WriteFile fails: backend unavailable, permission denied, conditional-write conflict (create=true and file already exists), quota or network failure.

Common situations: Two clients concurrently creating the same cluster config (conditional-write conflict), IAM lacking s3:PutObject, backend outage, KMS/encryption misconfiguration on the bucket.

Related errors

• error storing user provided keys %q %q: %v
• error reading full cluster spec for %q: %v
• error replacing SSHCredential: %v
• reading kops-channels manifest %s: %w
• error parsing ConfigStore.Base %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9504dd7eaccf596a. Report an issue: GitHub.