kubernetes/kops · critical

error writing updated configuration: %v

Error message

error writing updated configuration: %v

What it means

RunCreateCluster persists the cluster config, instance groups, and addons via registry.CreateClusterConfig. If that write to the state store fails, the command aborts with this wrapped error. Because this is the first real write, it typically surfaces state-store access problems (bad --state location, credentials, network).

Source

Thrown at cmd/kops/create_cluster.go:827

		case OutputYaml:
			if err := fullOutputYAML(out, obj...); err != nil {
				return fmt.Errorf("error writing cluster yaml to stdout: %v", err)
			}
			return nil
		case OutputJSON:
			if err := fullOutputJSON(out, true, obj...); err != nil {
				return fmt.Errorf("error writing cluster json to stdout: %v", err)
			}
			return nil
		default:
			return fmt.Errorf("unsupported output type %q", c.Output)
		}
	}

	// Note we perform as much validation as we can, before writing a bad config
	err = registry.CreateClusterConfig(ctx, clientset, cluster, instanceGroups, addons)
	if err != nil {
		return fmt.Errorf("error writing updated configuration: %v", err)
	}

	if len(c.SSHPublicKeys) == 0 {
		autoloadSSHPublicKeys := true
		switch c.CloudProvider {
		case "gce", "aws":
			autoloadSSHPublicKeys = false
		}

		if autoloadSSHPublicKeys {
			// Load from default locations, if found
			sshPublicKeyPaths := []string{
				"~/.ssh/id_ed25519.pub",
				"~/.ssh/id_rsa.pub",
			}
			var merr error
			for _, sshPublicKeyPath := range sshPublicKeyPaths {
				c.SSHPublicKeys, err = loadSSHPublicKeys(sshPublicKeyPath)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v for the storage-layer cause (permissions, not found, etc.).
2. Verify --state / KOPS_STATE_STORE points at an existing, writable location.
3. Check cloud credentials (aws sts get-caller-identity / gsutil ls).
4. Run `kops get clusters` against the same state store to check for a name collision.
5. Retry on transient network errors.

Example fix

// before
export KOPS_STATE_STORE=s3://nonexistent-bucket
kops create cluster ...
// after
aws s3 mb s3://my-kops-state-store
export KOPS_STATE_STORE=s3://my-kops-state-store
kops create cluster ...

if os.Getenv("KOPS_STATE_STORE") == "" && stateStore == "" {
	return fmt.Errorf("state store not configured")
}
// e.g. for s3: verify bucket exists and is writable before create
if strings.HasPrefix(stateStore, "s3://") {
	bucket := strings.TrimPrefix(stateStore, "s3://")
	if err := checkS3BucketWritable(bucket); err != nil {
		return err
	}
}

if err := runCreateCluster(...); err != nil {
	if strings.Contains(err.Error(), "error writing updated configuration") {
		// check state-store credentials/bucket, possibly retry on transient errors
	}
	return err
}

When it happens

Trigger: `kops create cluster` where the state store (S3/GCS/VFS) rejects the write: bucket missing, insufficient permission, state store unreachable, or a conflicting object at the cluster location.

Common situations: Wrong --state flag or KOPS_STATE_STORE env var; IAM credentials lacking s3:PutObject; bucket in a different region requiring a region flag; cluster name collision with an existing cluster.

Related errors

• error creating cluster: %v
• error querying cluster %q: %v
• error writing additional objects: %v
• cluster %q already exists; use 'kops update cluster' to appl
• error adding SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8f421c61496d2aca. Report an issue: GitHub.