What causes "group %q not found" in kubernetes/kops?

Create the missing group: `sudo groupadd `

group %q not found

Error message

group %q not found

What it means

EnsureFileOwner requires the requested group to exist on the local machine before changing file ownership. If LookupGroup returns no error but a nil group, kops fails with this explicit 'not found' error rather than silently skipping the chown. It is the group-side analogue of the user-not-found check.

Source

Thrown at upup/pkg/fi/files_owner.go:59

		user, err := LookupUser(owner) // user.Lookup(owner)
		if err != nil {
			return changed, fmt.Errorf("error looking up user %q: %v", owner, err)
		}
		if user == nil {
			return changed, fmt.Errorf("user %q not found", owner)
		}
		userID = user.Uid
	}

	actualGroupID := int(stat.Sys().(*syscall.Stat_t).Gid)
	groupID := actualGroupID
	if groupName != "" {
		group, err := LookupGroup(groupName)
		if err != nil {
			return changed, fmt.Errorf("error looking up group %q: %v", groupName, err)
		}
		if group == nil {
			return changed, fmt.Errorf("group %q not found", groupName)
		}
		groupID = group.Gid
	}

	if actualUserID == userID && actualGroupID == groupID {
		return changed, nil
	}

	klog.Infof("Changing file owner/group for %q to %s:%s", destPath, owner, groupName)
	err = os.Lchown(destPath, userID, groupID)
	if err != nil {
		return changed, fmt.Errorf("error setting file owner/group for %q: %v", destPath, err)
	}
	changed = true

	return changed, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Create the missing group: `sudo groupadd <name>`
Correct the group field in the spec to an existing group
Confirm resolution with `getent group <name>`
Leave group empty in the spec to preserve current group ownership

Example fix

// before
ensureFileOwner(path, "root", "kube")
// after
sudo groupadd kube  # or ensureFileOwner(path, "root", "")

Defensive patterns

Strategy: validation

Validate before calling

g, _ := user.LookupGroup(group); if g == nil { return fmt.Errorf("group %q not found; run groupadd %s or clear the group field", group, group) }

Try / catch

if _, err := fi.EnsureFileOwner(path, owner, group); err != nil { if strings.Contains(err.Error(), "group") && strings.Contains(err.Error(), "not found") { return fi.EnsureFileOwner(path, owner, "") } return err }

Prevention

Create all referenced groups on machines that run kOps rendering
List required users/groups in cluster docs/ansible playbooks
Use `getent group <name>` as a preflight check

When it happens

Trigger: RenderLocal on a file task whose group names a group absent from the local group database; LookupGroup(groupName) returns (nil, nil).

Common situations: Spec references a group (e.g. 'kube') that only exists on cluster nodes, not the machine running kOps; image or container lacking system groups; renamed/removed group after upgrade.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9af9dd8b35f4cf7c. Report an issue: GitHub.