InstanceGroupVFS Watch not implemented for vfs store

Error message

InstanceGroupVFS Watch not implemented for vfs store

What it means

InstanceGroupVFS is a filesystem (VFS) backed read-mostly client for kops InstanceGroups. Watch is a streaming API that the VFS-backed store never implemented, so it unconditionally returns this sentinel error. It signals that watching instance-group changes against a VFS (state-store) backend is not supported, not that a transient failure occurred.

Source

Thrown at pkg/client/simple/vfsclientset/instancegroup.go:138

	validation.ValidateInstanceGroup(g, nil, true)
	err = c.update(ctx, c.cluster, g)
	if err != nil {
		return nil, err
	}
	return g, nil
}

func (c *InstanceGroupVFS) Delete(ctx context.Context, name string, options metav1.DeleteOptions) error {
	return c.delete(ctx, name, options)
}

func (r *InstanceGroupVFS) DeleteCollection(ctx context.Context, options metav1.DeleteOptions, listOptions metav1.ListOptions) error {
	return fmt.Errorf("InstanceGroupVFS DeleteCollection not implemented for vfs store")
}

func (r *InstanceGroupVFS) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
	return nil, fmt.Errorf("InstanceGroupVFS Watch not implemented for vfs store")
}

func (r *InstanceGroupVFS) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *kopsapi.InstanceGroup, err error) {
	return nil, fmt.Errorf("InstanceGroupVFS Patch not implemented for vfs store")
}

View on GitHub (pinned to 4c8573c808)

Solutions

Do not use Watch with the VFS-backed clientset; poll List instead (e.g. List on a ticker).
Switch to a clientset backed by the Kubernetes API (kubecfg / API machine) if live watch semantics are required.
Patch InstanceGroupVFS.Watch to implement polling-based watch.Interface if you control the fork.

Example fix

// before
w, err := igClient.Watch(ctx, metav1.ListOptions{})
// after
for {
  list, err := igClient.List(ctx, metav1.ListOptions{})
  if err != nil { return err }
  process(list)
  time.Sleep(30 * time.Second)
}

Defensive patterns

Strategy: fallback

Validate before calling

// feature-check before using watch on VFS-backed store
if _, ok := igClient.(interface{ Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) }); ok {
  // VFS impl always errors; prefer polling
}

Try / catch

w, err := igClient.Watch(ctx, opts)
if err != nil && strings.Contains(err.Error(), "not implemented") {
  return pollLoop(ctx, igClient) // fallback to List polling
}

Prevention

Never assume watch support on VFS-backed clientsets; check docs first.
Build a polling abstraction for state-store-backed listings.
Prefer the Kubernetes API clientset for watch semantics.

When it happens

Trigger: Calling Watch(ctx, opts) on an InstanceGroupVFS client obtained from the simple clientset when the cluster state is stored in a VFS path (S3/GCS/etc. backend via kops state store).

Common situations: Controllers or tools ported from typed kubernetes clientsets that rely on watch semantics, running against a kops cluster whose state store is VFS-based instead of the Kubernetes API.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1ac9219cfa2965e3. Report an issue: GitHub.