kubernetes/kops · error

the %q path does not support public ACL

Error message

the %q path does not support public ACL

What it means

getACL switches on the concrete vfs.Path type to build an ACL for public ManagedFiles. If the path type is not S3Path or MemFSPath, there is no public-ACL implementation, so it fails with this error listing the path.

Source

Thrown at upup/pkg/fi/fitasks/managedfile.go:147

	ctx := c.Context()

	publicRead := s3types.ObjectCannedACLPublicRead
	var acl vfs.ACL
	if fi.ValueOf(e.PublicACL) {
		switch p := p.(type) {
		case *vfs.S3Path:
			acl = &vfs.S3Acl{
				RequestACL: &publicRead,
			}
		case *vfs.MemFSPath:
			if !p.IsClusterReadable() {
				return nil, fmt.Errorf("the %q path is intended for use in tests", p.Path())
			}
			acl = &vfs.S3Acl{
				RequestACL: &publicRead,
			}
		default:
			return nil, fmt.Errorf("the %q path does not support public ACL", p.Path())
		}
		return acl, nil
	}

	return acls.GetACL(ctx, p, c.T.Cluster)
}

func (_ *ManagedFile) Render(c *fi.CloudupContext, a, e, changes *ManagedFile) error {
	ctx := c.Context()

	location := fi.ValueOf(e.Location)
	if location == "" {
		return fi.RequiredField("Location")
	}

	data, err := fi.ResourceAsBytes(e.Contents)
	if err != nil {
		return fmt.Errorf("error reading contents of ManagedFile: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Store the ManagedFile on an S3-backed path, or make the file non-public so the generic acls.GetACL path is used instead.
2. Check the ManagedFile public flag in the cluster spec; set it false when not using S3.
3. If GCS support is needed, extend getACL with the corresponding ACL type upstream.

Example fix

// before: public managedfile on GCS
base: "gs://my-bucket/cluster"
// after: move to S3 or disable public ACL
base: "s3://my-bucket/cluster"

p, err := vfs.Context.BuildVfsPath(base)
if err != nil { return err }
if _, ok := p.(*vfs.S3Path); !ok && publicAccessRequired {
    return fmt.Errorf("public ACL requires S3 path, got %T", p)
}

_, ok := p.(*vfs.S3Path); return ok

if err != nil { return fmt.Errorf("getACL failed for %s: %w", p.Path(), err) }

When it happens

Trigger: Render or RenderTerraform of a ManagedFile with public access whose base path resolves to a VFS type without public ACL support (e.g. gs://, file paths, or other non-S3 backends).

Common situations: Using a GCS or other cloud state store while the ManagedFile is configured to be publicly readable — public ACL logic is S3-specific.

Related errors

• the %q path is intended for use in tests
• write to %s with ACL of unexpected type %T
• error reading addons from %q: %v
• error reading etcd manifest %s: %v
• cannot parse VFS path %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0bf368af91f143bb. Report an issue: GitHub.