kubernetes/kops · error

path is not cluster readable: %v

Error message

path is not cluster readable: %v

What it means

AddS3Permissions only knows how to grant S3 IAM permissions for S3Path, MemFSPath (tests) and FSPath (tests). When a state-store root resolves to any other vfs.Path implementation, kOps refuses rather than emit wrong permissions, returning 'path is not cluster readable'. The comment in source says all clouds should use cluster-readable storage instead of this fallback.

Source

Thrown at pkg/model/iam/iam_builder.go:626

				return err
			}

		case *vfs.MemFSPath:
			// Tests - we emulate the s3 permissions so that we can get an idea of the full policy

			iamS3Path := "placeholder-read-bucket/" + path.Location()
			b.buildS3GetStatements(p, iamS3Path)
			s3Buckets.Insert("placeholder-read-bucket")
		case *vfs.FSPath:
			// tests - we emulate the s3 permissions so that we can get an idea of the full policy

			iamS3path := "placeholder-read-bucket/" + strings.TrimPrefix(path.Path(), "file://")
			b.buildS3GetStatements(p, iamS3path)
			s3Buckets.Insert("placeholder-read-bucket")
		default:
			// We could implement this approach, but it seems better to
			// get all clouds using cluster-readable storage
			return fmt.Errorf("path is not cluster readable: %v", root)
		}
	}

	writeablePaths, err := WriteableVFSPaths(b.Cluster, b.Role)
	if err != nil {
		return err
	}

	for _, vfsPath := range writeablePaths {
		switch path := vfsPath.(type) {
		case *vfs.S3Path:
			iamS3Path := path.Bucket() + "/" + path.Key()
			iamS3Path = strings.TrimSuffix(iamS3Path, "/")

			b.buildS3WriteStatements(p, iamS3Path)
			s3Buckets.Insert(path.Bucket())
		case *vfs.MemFSPath:
			iamS3Path := "placeholder-write-bucket/" + path.Location()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm you are building AWS IAM policies against an s3:// state store; switch --state to an S3 bucket if you pointed at another cloud's store.
2. If you truly need non-S3 storage, this is unsupported for AWS IAM synthesis — create an S3 state store and `kops replace`/migrate the cluster config.
3. Check the kOps version for backend support; upgrade if a newer release added cluster-readable support for your storage type.
4. For tests, use vfs.MemFSPath or a file:// FSPath which are emulated as placeholder buckets.

Example fix

// before: AWS cluster built against GCS state store
--state gs://my-kops-bucket/clusters/example.k8s.local
// after
--state s3://my-kops-bucket/clusters/example.k8s.local

// Resolve the store first and require an S3-backed path
vfsPath, err := vfs.Context.BuildVfsPath(stateStore)
if err != nil { return err }
if _, ok := vfsPath.(*vfs.S3Path); !ok {
    return fmt.Errorf("state store %q is not cluster-readable S3 storage", stateStore)
}

func isS3Path(p vfs.Path) bool { _, ok := p.(*vfs.S3Path); return ok }

if err := builder.AddS3Permissions(policy); err != nil {
    if strings.Contains(err.Error(), "not cluster readable") {
        // switch to an s3:// state store and retry
    }
    return err
}

When it happens

Trigger: Building AWS IAM policies while the cluster state store root resolves to a non-S3, non-test filesystem VFS type — e.g. a gs:// (GCS), azure://, or swift:// path passed into AWS policy generation, or any newly added VFS backend lacking a case in the switch.

Common situations: Migrating a cluster between clouds and reusing a GCS/Azure state store with AWS IAM building; CI harness using an unexpected VFS implementation; kOps version where a backend type was added but IAM builder support is missing.

Related errors

• cannot parse VFS path %q: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• building VFS path for %q: %w
• rendering S3 file: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3642e523237fac5. Report an issue: GitHub.