kubernetes/kops · error

unexpected acl type %T

Error message

unexpected acl type %T

What it means

WriteFile accepts an ACL of the vfs package's ACL interface type. For SSH paths the only valid non-nil ACL is *SSHAcl, which carries a permission Mode. If the caller passes any other ACL implementation (e.g. *S3Acl, *VFSAcl from a different backend), the type assertion fails and this error is returned before chmod.

Source

Thrown at util/pkg/vfs/sshfs.go:223

			// Something went wrong; try to remove the temp file
			if err := sftpClient.Remove(tempfile); err != nil {
				klog.Warningf("unable to remove temp file %q: %v", tempfile, err)
			}
		}
	}()
	if _, err := io.Copy(f, data); err != nil {
		return fmt.Errorf("writing to sftp temp file: %w", err)
	}

	shouldClose = false
	if err := f.Close(); err != nil {
		return err
	}

	if acl != nil {
		sshACL, ok := acl.(*SSHAcl)
		if !ok {
			return fmt.Errorf("unexpected acl type %T", acl)
		} else {
			err = sftpClient.Chmod(tempfile, sshACL.Mode)
			if err != nil {
				return fmt.Errorf("error during chmod of %q: %w", tempfile, err)
			}
		}
	}

	// posix rename will replace the destination (normal sftp rename does not)
	usePosixRename := true
	if usePosixRename {
		// posix rename fails if destination exists, try to delete just in case
		if err := sftpClient.Remove(p.path); err != nil {
			if os.IsNotExist(err) {
				// expected when file does not exist already
			} else {
				return fmt.Errorf("removing destination sftp file %q before rename: %w", p.path, err)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass vfs.NewSSHAcl(mode) (e.g. os.FileMode(0o600)) when writing to SSHPath targets.
2. Pass nil as the acl argument if no special permissions are needed.
3. If ACLs come from generic code, branch on the path type and build the backend-appropriate ACL.
4. Inspect the %T in the error to identify exactly which ACL type was wrongly supplied.

Example fix

// before
path.WriteFile(ctx, data, vfs.NewS3Acl("private")) // wrong backend ACL
// after
path.WriteFile(ctx, data, vfs.NewSSHAcl(0o600))

func isSSHAcl(acl vfs.ACL) (*vfs.SSHAcl, bool) {
    if acl == nil { return nil, false }
    a, ok := acl.(*vfs.SSHAcl)
    return a, ok
}

err := path.WriteFile(ctx, data, acl)
if err != nil && strings.Contains(err.Error(), "unexpected acl type") {
    // rebuild acl for SSH backend
    return path.WriteFile(ctx, data, vfs.NewSSHAcl(0o600))
}

When it happens

Trigger: Calling WriteFile/CreateFile on an SSHPath with acl set to a non-nil value that is not *vfs.SSHAcl — e.g. reusing an ACL object constructed for S3/GS/DO paths.

Common situations: Generic vfs code paths that build an ACL for one backend and pass it to another; copy-pasted code switching from s3:// to ssh:// targets; custom ACL implementations not deriving from SSHAcl.

Related errors

• unexpected kind for cluster, got %T, want kops.Cluster
• connecting: %w
• unable to SSH to %q: %v
• error listing systemd services: %v
• error reading /var/log: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4139b658032555cd. Report an issue: GitHub.