kubernetes/kops · error

expected acl to be S3Acl, was %T

Error message

expected acl to be S3Acl, was %T

What it means

MemFSPath.IsPublic only understands S3-style ACLs; it type-asserts the path's stored ACL to *S3Acl and fails if the concrete type differs. Since MemFS reuses S3Acl as its ACL representation, any other ACL type (e.g. a GCS-style ACL) is rejected.

Source

Thrown at util/pkg/vfs/memfs.go:221

	return nil
}

func (p *MemFSPath) RemoveAllVersions(ctx context.Context) error {
	return p.Remove(ctx)
}

func (p *MemFSPath) Location() string {
	return p.location
}

func (p *MemFSPath) IsPublic() (bool, error) {
	if p.acl == nil {
		return false, nil
	}
	s3Acl, ok := p.acl.(*S3Acl)
	if !ok {
		return false, fmt.Errorf("expected acl to be S3Acl, was %T", p.acl)
	}
	isPublic := false
	if s3Acl.RequestACL != nil {
		isPublic = *s3Acl.RequestACL == "public-read"
	}
	return isPublic, nil
}

type terraformMemFSFile struct {
	Bucket   string                   `json:"bucket" cty:"bucket"`
	Key      string                   `json:"key" cty:"key"`
	Content  *terraformWriter.Literal `json:"content,omitempty" cty:"content"`
	Acl      *string                  `json:"acl,omitempty" cty:"acl"`
	SSE      string                   `json:"server_side_encryption,omitempty" cty:"server_side_encryption"`
	Provider *terraformWriter.Literal `json:"provider,omitempty" cty:"provider"`
}

func (p *MemFSPath) RenderTerraform(w *terraformWriter.TerraformWriter, name string, data io.Reader, acl ACL) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Store ACLs on MemFSPath as *vfs.S3Acl (e.g. vfs.NewACL(...)/S3Acl with RequestACL set) instead of a custom type
2. If the ACL truly is another type, extend IsPublic (or the caller) to handle it instead of relying on the S3 assertion
3. Skip the IsPublic check when the ACL type is unknown; treat as not-public only for *S3Acl

Example fix

// before
p.SetACL(ctx, myCustomACL{...})
p.IsPublic() // panics into error: expected acl to be S3Acl
// after
p.SetACL(ctx, &vfs.S3Acl{RequestACL: ptr.To("public-read")})
isPublic, err := p.IsPublic()

func aclIsPublicSafe(acl vfs.ACL) (bool, error) { if acl == nil { return false, nil }; s3, ok := acl.(*vfs.S3Acl); if !ok { return false, nil }; return s3.RequestACL != nil && *s3.RequestACL == "public-read", nil }

func asS3Acl(acl vfs.ACL) (*vfs.S3Acl, bool) { s, ok := acl.(*vfs.S3Acl); return s, ok }

isPublic, err := p.IsPublic()
if err != nil && strings.Contains(err.Error(), "expected acl to be S3Acl") {
    return false, nil // non-S3 ACL: treat as not public
}

When it happens

Trigger: Setting a path's ACL with a non-*S3Acl value (e.g. in tests) and then calling IsPublic on that path while the ACL is non-nil.

Common situations: Test code constructing memfs paths with custom/mock ACL types; code paths ported from GCS that attach gsutil-style ACLs; refactors introducing a new ACL type not handled by IsPublic's assertion.

Related errors

• write to %s with ACL of unexpected type %T
• unexpected kind for cluster, got %T, want kops.Cluster
• the %q path is intended for use in tests
• the %q path does not support public ACL
• error building acl for secret %q for mirror: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c71113044f0064e1. Report an issue: GitHub.