kubernetes/kops · error

the %q path is intended for use in tests

Error message

the %q path is intended for use in tests

What it means

ManagedFile's getACL determines an ACL when publishing a file with public (public-read) access. For a MemFS path (in-memory filesystem), public ACL is only meaningful for cluster-readable test paths; any other MemFS path is rejected because MemFS is meant for tests only.

Source

Thrown at upup/pkg/fi/fitasks/managedfile.go:141

		return field.Required(field.NewPath("Contents"), "")
	}
	return nil
}

func (e *ManagedFile) getACL(c *fi.CloudupContext, p vfs.Path) (vfs.ACL, error) {
	ctx := c.Context()

	publicRead := s3types.ObjectCannedACLPublicRead
	var acl vfs.ACL
	if fi.ValueOf(e.PublicACL) {
		switch p := p.(type) {
		case *vfs.S3Path:
			acl = &vfs.S3Acl{
				RequestACL: &publicRead,
			}
		case *vfs.MemFSPath:
			if !p.IsClusterReadable() {
				return nil, fmt.Errorf("the %q path is intended for use in tests", p.Path())
			}
			acl = &vfs.S3Acl{
				RequestACL: &publicRead,
			}
		default:
			return nil, fmt.Errorf("the %q path does not support public ACL", p.Path())
		}
		return acl, nil
	}

	return acls.GetACL(ctx, p, c.T.Cluster)
}

func (_ *ManagedFile) Render(c *fi.CloudupContext, a, e, changes *ManagedFile) error {
	ctx := c.Context()

	location := fi.ValueOf(e.Location)
	if location == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use a real VFS backend (e.g. s3:// state store) for the ManagedFile Base instead of memfs://.
2. If this is genuinely a test, ensure the MemFSPath is created cluster-readable.
3. Remove the requirement for public ACL on the file if it should stay private.

Example fix

// before
base: "memfs://tests"
// after
base: "s3://my-kops-state-store/cluster.example.com"

p, err := vfs.Context.BuildVfsPath(base)
if err != nil { return err }
if _, ok := p.(*vfs.MemFSPath); ok && !p.IsClusterReadable() {
    return fmt.Errorf("memfs path %q not valid outside tests", p.Path())
}

if mp, ok := p.(*vfs.MemFSPath); ok { return mp.IsClusterReadable() }
return true

if err != nil { return fmt.Errorf("public ACL unsupported for %s: %w", p.Path(), err) }

When it happens

Trigger: getACL (called by Render/RenderTerraform) is given a vfs.MemFSPath that is not cluster-readable — i.e. requesting public ACL on an in-memory path outside a test scenario.

Common situations: Running kops against a test/in-memory state store while the ManagedFile requires a public ACL; misconfigured base path pointing to memfs:// in a real cluster apply.

Related errors

• the %q path does not support public ACL
• write to %s with ACL of unexpected type %T
• error reading addons from %q: %v
• error reading etcd manifest %s: %v
• cannot parse VFS path %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7368810a37462e55. Report an issue: GitHub.