kubernetes/kops · error

featureflag GoogleCloudBucketACL not supported with per-inst

Error message

featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount

What it means

A configuration-compatibility guard: the legacy GoogleCloudBucketACL feature flag is enabled while the cluster has no cluster-level GCE service account (i.e. uses per-instancegroup accounts); the ACL mechanism requires the cluster-level account, so the build is halted rather than producing broken ACLs.

Source

Thrown at pkg/model/gcemodel/storageacl.go:48

	"k8s.io/kops/upup/pkg/fi/cloudup/gcetasks"
	"k8s.io/kops/util/pkg/vfs"
)

// StorageAclBuilder configures storage acls
type StorageAclBuilder struct {
	*GCEModelContext
	Cloud     gce.GCECloud
	Lifecycle fi.Lifecycle
}

var _ fi.CloudupModelBuilder = &StorageAclBuilder{}

// Build creates the tasks that set up storage acls

func (b *StorageAclBuilder) Build(c *fi.CloudupModelBuilderContext) error {
	if featureflag.GoogleCloudBucketACL.Enabled() {
		if b.Cluster.Spec.CloudProvider.GCE.ServiceAccount == "" {
			return fmt.Errorf("featureflag GoogleCloudBucketACL not supported with per-instancegroup GCEServiceAccount")
		}

		klog.Warningf("featureflag GoogleCloudBucketACL is no longer recommended; use per-instancegroup GCEServiceAccounts instead")

		gceDefaultServiceAccount, err := b.Cloud.ServiceAccount()
		if err != nil {
			return fmt.Errorf("error fetching default ServiceAccount: %w", err)
		}

		clusterPath := b.Cluster.Spec.ConfigStore.Base
		p, err := vfs.Context.BuildVfsPath(clusterPath)
		if err != nil {
			return fmt.Errorf("cannot parse cluster path %q: %w", clusterPath, err)
		}

		if p, ok := p.(*vfs.GSPath); ok {
			// It's not ideal that we have to do this at the bucket level,
			// but GCS doesn't seem to have a way to do subtrees (like AWS IAM does)

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Disable the GoogleCloudBucketACL feature flag (deprecated) and rely on per-IG service-account IAM bindings
  2. Or set a cluster-level cloudProvider.gce.serviceAccount
  3. Re-run kops update
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at pkg/model/gcemodel/storageacl.go:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/820fc938f57f213c. Report an issue: GitHub.