What causes "unable to transfer %q to %q: %v" in kubernetes/kops?

Diagnose the innermost error after the second colon — it carries the real cause.

unable to transfer %q to %q: %v

Error message

unable to transfer %q to %q: %v

What it means

CopyFile.Run() delegates the actual download-validate-upload to transferFile(); any failure there is wrapped as "unable to transfer <source> to <target>: <reason>". This names both ends of the copy so the developer can tell which asset and which repository failed.

Source

Thrown at pkg/assets/assetcopy/copyfile.go:96

	} else {
		targetSHA := string(targetSHABytes)

		if strings.TrimSpace(targetSHA) == expectedSHA {
			klog.V(8).Infof("found matching target sha for file: %q", e.TargetFile)
			return nil
		}

		klog.V(8).Infof("did not find same file, found mismatching target sha1 for file: %q", e.TargetFile)
	}

	source := e.SourceFile
	target := e.TargetFile
	sourceSha := e.SHA

	klog.V(2).Infof("copying bits from %q to %q", source, target)

	if err := transferFile(ctx, e.VFSContext, e.Cluster, source, target, sourceSha); err != nil {
		return fmt.Errorf("unable to transfer %q to %q: %v", source, target, err)
	}

	return nil
}

// transferFile downloads a file from the source location, validates the file matches the SHA,
// and uploads the file to the target location.
func transferFile(ctx context.Context, vfsContext *vfs.VFSContext, cluster *kops.Cluster, source string, target string, sha string) error {
	// TODO drop file to disk, as vfs reads file into memory.  We load kubelet into memory for instance.
	// TODO in s3 can we do a copy file ... would need to test

	data, err := vfsContext.ReadFile(source)
	if err != nil {
		if os.IsNotExist(err) {
			return fmt.Errorf("file not found %q: %v", source, err)
		}

		return fmt.Errorf("error downloading file %q: %v", source, err)

View on GitHub (pinned to 4c8573c808)

Solutions

Diagnose the innermost error after the second colon — it carries the real cause.
Check credentials/IAM (s3:PutObject, storage.objects.create) for the target repository.
Verify both source canonical URL and target file-repository URL in `kops get assets --copy` flags.
Re-run the copy after fixing; CopyFile skips assets whose target .sha file already matches.

Example fix

// before
kops get assets --copy --file-repository s3://wrong-bucket/path
// after
kops get assets --copy --file-repository s3://my-assets-bucket/bin

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify both endpoints before copying:
if code := headStatus(sourceFile); code != 200 { return fmt.Errorf("source %s -> %d", sourceFile, code) }
if err := canWrite(targetRepo); err != nil { return fmt.Errorf("target %s not writable: %v", targetRepo, err) }

Try / catch

err := copyFileTask.Run()
if err != nil {
    var inner error
    if strings.HasPrefix(err.Error(), "unable to transfer") {
        inner = errors.Unwrap(err) // or parse the text; root cause follows ": "
    }
    return fmt.Errorf("copy failed: %w", err)
}

Prevention

Check the innermost error text after the two colons for the real cause
Confirm IAM write permissions on the target repository first
Verify source URLs exist before bulk runs
Use a file repository whose URL scheme kops recognizes (s3://, gs://, azureblob://, file://)

When it happens

Trigger: transferFile fails for any reason — source file missing (784), download error (785), VFS path build error (786/787), sha parse/hash mismatch (788/789), or the final WriteFile to the target repository failing (permissions, bucket missing, quota).

Common situations: `kops get assets --copy` targeting a private S3/GCS bucket that the current credentials cannot write to; source mirror temporarily down; wrong file-repository URL in the cluster spec.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3187ffbed3bf2d6. Report an issue: GitHub.