What causes "reading embedded file %q: %w" in kubernetes/kops?

Rebuild the kops binary with a clean build cache: go clean -cache && make kops

reading embedded file %q: %w

Error message

reading embedded file %q: %w

What it means

GetHash walks the go:embed filesystem of assetdata and reads every embedded YAML manifest. This error wraps any fs.ReadFile failure encountered while reading an embedded file during that walk. Because the files are compiled into the binary, this almost always indicates a corrupted/inconsistent build or an fs abstraction failure rather than a runtime disk problem.

Source

Thrown at pkg/assets/assetdata/data.go:49

//go:embed *.yaml
var embeddedDataFS embed.FS

// GetHash returns the stored hash for the well-known asset, looking it up by the canonicalURL.
// If found, it returns (hash, true, nil)
// If not found, it returns (nil, false, nil)
func GetHash(canonicalURL *url.URL) (*hashing.Hash, bool, error) {
	var allMatches []*file

	if err := fs.WalkDir(embeddedDataFS, ".", func(p string, d fs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if d.IsDir() {
			return nil
		}
		b, err := fs.ReadFile(embeddedDataFS, p)
		if err != nil {
			return fmt.Errorf("reading embedded file %q: %w", p, err)
		}

		manifest, err := parseManifestFile(b)
		if err != nil {
			return fmt.Errorf("parsing embedded file %q: %w", p, err)
		}

		matches := manifest.Matches(canonicalURL.String())
		allMatches = append(allMatches, matches...)
		return nil
	}); err != nil {
		return nil, false, fmt.Errorf("walking embedded data: %w", err)
	}

	hashes := sets.New[string]()
	for _, match := range allMatches {
		hashes.Insert(match.SHA256)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Rebuild the kops binary with a clean build cache: go clean -cache && make kops
Verify the binary embeds the manifests: go:embed *.yaml files exist under pkg/assets/assetdata/
Re-download or re-install the kops release binary if the checksum mismatches
Report a bug with the wrapped inner error if it persists on a fresh official build

Example fix

// before: using a damaged third-party build
./kops-with-broken-embed get assets
// after: rebuild from source
go clean -cache && make kops && ./kops get assets

Defensive patterns

Strategy: try-catch

Validate before calling

// Embedded FS cannot be validated at runtime; verify the build instead:
// go test ./pkg/assets/assetdata/ -run TestGetHash
if _, ok := interface{}(err).(*fs.PathError); ok { /* embedded FS read failure */ }

Type guard

func isFSErr(err error) bool {
	var pe *fs.PathError
	return errors.As(err, &pe)
}

Try / catch

h, found, err := assetdata.GetHash(u)
if err != nil {
	if isFSErr(err) {
		// fail fast: binary asset data is corrupt; do not retry
		return fmt.Errorf("asset data unreadable, rebuild binary: %w", err)
	}
	return err
}

Prevention

Run TestGetHash in CI to validate embedded manifests after every build
Verify binary checksums before deploying kops artifacts
Avoid mutating go:embed source files outside the generator
Rebuild from clean cache if embed-related errors appear

When it happens

Trigger: Calling assetdata.GetHash when fs.ReadFile fails on an embedded path during the WalkDir callback — e.g. the embed.FS was populated inconsistently at build time or a path race/IO error occurs while walking.

Common situations: Broken/incomplete go build cache or corrupted binary; embedding directives changed (//go:embed *.yaml) so a file vanished mid-build; running an artifact built on a damaged filesystem.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c4c60c4e60c19fba. Report an issue: GitHub.