kubernetes/kops · error

locationStore=%q is only supported in tests

Error message

locationStore=%q is only supported in tests

What it means

If DiscoveryStore resolves to a vfs.MemFSPath that has not been marked cluster-readable, the issuer URL cannot be used outside of tests. kOps returns this error to indicate memfs discovery stores are only valid in unit tests after calling MarkClusterReadable.

Source

Thrown at pkg/model/components/discovery.go:72

			base, err := vfs.Context.BuildVfsPath(store)
			if err != nil {
				return fmt.Errorf("error parsing locationStore=%q: %w", store, err)
			}
			switch base := base.(type) {
			case *vfs.S3Path:
				serviceAccountIssuer, err = base.GetHTTPsUrl(clusterSpec.IsIPv6Only())
				if err != nil {
					return err
				}
			case *vfs.GSPath:
				serviceAccountIssuer, err = base.GetHTTPsUrl()
				if err != nil {
					return err
				}
			case *vfs.MemFSPath:
				if !base.IsClusterReadable() {
					// If this _is_ a test, we should call MarkClusterReadable
					return fmt.Errorf("locationStore=%q is only supported in tests", store)
				}
				serviceAccountIssuer = strings.Replace(base.Path(), "memfs://", "https://", 1)
			default:
				return fmt.Errorf("locationStore=%q is of unexpected type %T", store, base)
			}
		} else if said != nil && said.DiscoveryService != nil {
			discoveryService := said.DiscoveryService

			serviceAccountIssuer = discoveryService.URL
			if serviceAccountIssuer == "" {
				return fmt.Errorf("discoveryService URL must be specified")
			}
		} else {
			if supportsPublicJWKS(clusterSpec) && clusterSpec.API.PublicName != "" {
				serviceAccountIssuer = "https://" + clusterSpec.API.PublicName
			} else {
				serviceAccountIssuer = "https://api.internal." + b.ClusterName
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. In tests, call base.MarkClusterReadable() on the MemFSPath before building options
2. For real clusters, replace memfs:// discoveryStore with a real object store (e.g. s3://) so an HTTPS issuer URL can be derived

Example fix

// before
vfs.Context.WriteFile("memfs://discovery/jwks", data, 0644)
// after
p := vfs.Context.ReadFile("memfs://discovery/jwks") // MemFSPath
p.(*vfs.MemFSPath).MarkClusterReadable()

if strings.HasPrefix(store, "memfs://") && !isTest {
    return fmt.Errorf("memfs discoveryStore is only for tests")
}

func isClusterReadableMemFS(base vfs.VFSPath) bool {
    m, ok := base.(*vfs.MemFSPath)
    return ok && m.IsClusterReadable()
}

if err := buildOptions(); err != nil {
    if strings.Contains(err.Error(), "is only supported in tests") {
        // call MarkClusterReadable on the MemFSPath and retry
    }
    return err
}

When it happens

Trigger: A cluster spec with serviceAccountIssuerDiscovery.discoveryStore pointing at memfs:// in a real (non-test) build, or a test that built a MemFSPath without calling MarkClusterReadable.

Common situations: Leftover test configuration (memfs) applied to a real cluster; unit test forgetting MarkClusterReadable before BuildOptions.

Related errors

• no keypair ID for %q
• error parsing locationStore=%q: %w
• locationStore=%q is of unexpected type %T
• discoveryService URL must be specified
• building nodeConfig for instanceGroup: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cc314e93ca6045f2. Report an issue: GitHub.