kubernetes/kops · error

unhandled type %T

Error message

unhandled type %T

What it means

The discoveryStore VFS path parsed to a concrete type kops' IssuerDiscoveryModelBuilder does not support. The builder only handles *vfs.S3Path, *vfs.GSPath and *vfs.MemFSPath; any other VFS implementation (e.g. a filesystem or vault path) reaches the default branch and fails with the Go type name of the unhandled path.

Source

Thrown at pkg/model/issuerdiscovery.go:130

		if discoveryStoreURL == fi.ValueOf(b.Cluster.Spec.KubeAPIServer.ServiceAccountIssuer) {
			// Using Google Cloud Storage requires public access
			isPublic, err := discoveryStore.IsBucketPublic(ctx)
			if err != nil {
				return fmt.Errorf("checking if bucket was public: %w", err)
			}
			if !isPublic {
				klog.Infof("serviceAccountIssuers bucket %q is not public; will use object ACL", discoveryStore.Bucket())
				publicFileACL = new(true)
			}
		} else {
			klog.Infof("using user managed serviceAccountIssuers")
		}

	case *vfs.MemFSPath:
		// ok

	default:
		return fmt.Errorf("unhandled type %T", discoveryStore)
	}

	keysFile := &fitasks.ManagedFile{
		Contents:  keys,
		Lifecycle: b.Lifecycle,
		Location:  new("openid/v1/jwks"),
		Name:      new("keys.json"),
		Base:      new(discoveryStorePath),
		PublicACL: publicFileACL,
	}
	c.AddTask(keysFile)

	discoveryFile := &fitasks.ManagedFile{
		Contents:  fi.NewBytesResource(discovery),
		Lifecycle: b.Lifecycle,
		Location:  new(".well-known/openid-configuration"),
		Name:      new("discovery.json"),
		Base:      new(discoveryStorePath),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Change discoveryStore to an S3 or GCS bucket path: s3://bucket/prefix or gs://bucket/prefix.
2. If testing locally, use a memfs:// path (handled as a no-op) rather than a file:// path.
3. Check the kops docs for supported OIDC discovery stores for your cloud provider; other clouds require serving discovery via a different mechanism (e.g. configStore with an external web server).
4. Remove serviceAccountIssuerDiscovery entirely if you serve OIDC discovery out-of-band.

Example fix

// before
spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: /mnt/oidc
// after
spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: s3://my-oidc-bucket/cluster.example.com

// Narrow the discoveryStore to supported backends before applying:
store := cluster.Spec.ServiceAccountIssuerDiscovery.DiscoveryStore
switch {
case strings.HasPrefix(store, "s3://"), strings.HasPrefix(store, "gs://"), strings.HasPrefix(store, "memfs://"):
    // supported
default:
    return fmt.Errorf("discoveryStore %q unsupported: only s3://, gs:// (or memfs:// for tests) are handled", store)
}

func isSupportedDiscoveryStore(store string) bool {
    return strings.HasPrefix(store, "s3://") || strings.HasPrefix(store, "gs://") || strings.HasPrefix(store, "memfs://")
}

When it happens

Trigger: `kops update cluster` with cluster.spec.serviceAccountIssuerDiscovery.discoveryStore set to a supported-to-parse but unsupported-for-publishing path, e.g. file://, /local/path, vfs:/// or another non-S3/non-GS VFS scheme.

Common situations: Pointing discoveryStore at a local filesystem path during testing and forgetting to switch to s3:// or gs://, using an OSS/Azure/DO storage URL that VFS parses but the OIDC publisher does not implement, or running on a cloud provider whose builder adds no discovery-store support.

Related errors

• building VFS path for %q: %w
• unexpected kind for cluster, got %T, want kops.Cluster
• method ConfigBaseFor not supported in server-side client
• ResourceVersion not supported in InstanceGroupVFS::Get
• reading file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b8936512af341238. Report an issue: GitHub.