kubernetes/kops · error

reading file: %w

Error message

reading file: %w

What it means

After successfully building the VFS path, the code reads the object content with srcPath.ReadFile(ctx). Any read failure (object missing, permission denied, network error) is wrapped as 'reading file: %w'. The error path exists so individual additional-file fetch failures abort bootstrap-data building with a clear cause.

Source

Thrown at pkg/commands/toolbox_enroll.go:881

		remapPrefix := "s3://" // TODO: Support GCS?

		// targetDir is the location of the config on the target node.
		targetDir := "/etc/kubernetes/kops/config"

		// remapFile remaps a file from s3/gcs etc to the local file system on the target node.
		remapFile := func(pSrc *string, destDir string) error {
			src := *pSrc
			if !strings.HasPrefix(src, remapPrefix) {
				return nil
			}

			srcPath, err := vfsContext.BuildVfsPath(src)
			if err != nil {
				return fmt.Errorf("building vfs path: %w", err)
			}
			b, err := srcPath.ReadFile(ctx)
			if err != nil {
				return fmt.Errorf("reading file: %w", err)
			}

			dest := strings.TrimPrefix(src, remapPrefix)
			dest = path.Join(destDir, dest)
			bootstrapData.NodeupScriptAdditionalFiles[dest] = b

			*pSrc = dest
			return nil
		}

		// remapTree remaps a file tree from s3/gcs etc to the local file system on the target node.
		remapTree := func(pSrc *string, dest string) error {
			src := *pSrc
			if !strings.HasPrefix(src, remapPrefix) {
				return nil
			}

			srcPath, err := vfsContext.BuildVfsPath(src)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause to distinguish not-found vs permission vs network.
2. Verify the object exists: `aws s3 ls <path>` (or equivalent for your backend).
3. Grant read permission / KMS decrypt to the caller's credentials.
4. Retry on transient network errors with backoff.

Example fix

// before
b, err := srcPath.ReadFile(ctx) // fails: object deleted
// after
aws s3 cp ./conf.yaml s3://bucket/files/conf.yaml  # re-upload referenced file, then retry

// Confirm the referenced object exists before enrollment
_, err := os.Stat(localPath) // or aws s3 ls s3://bucket/files/conf.yaml
if err != nil {
	return fmt.Errorf("additional file %s missing", src)
}

if err != nil {
	if os.IsPermission(errors.Unwrap(err)) {
		return fmt.Errorf("access denied reading %s: fix IAM/KMS", src)
	}
	return retry.WithBackoff(func() error { _, err := srcPath.ReadFile(ctx); return err }, 3)
}

When it happens

Trigger: BuildVfsPath succeeded but ReadFile fails: the object does not exist at the path, the caller lacks s3:GetObject/gs read permission, or a transient network/backend error occurs.

Common situations: Additional file deleted from the bucket after being referenced; bucket policy/KMS denies the current principal; object in a different region/account than assumed; transient S3 5xx/timeout.

Related errors

• reading tree: %w
• error writing secret to %q: %v
• unexpected kind for cluster, got %T, want kops.Cluster
• method ConfigBaseFor not supported in server-side client
• ResourceVersion not supported in InstanceGroupVFS::Get

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9896968e5521f6f7. Report an issue: GitHub.