What causes "user %q not found" in kubernetes/kops?

Create the missing user on the host, e.g. `sudo useradd `

user %q not found

Error message

user %q not found

What it means

EnsureFileOwner sets the unix user/group ownership of a file during local rendering (e.g. node/cluster asset generation). After looking up the requested owner name via LookupUser, if the lookup returns neither an error nor a user, kops treats the username as nonexistent and aborts. This guards against silently leaving a file with the wrong owner when the target user does not exist on the machine.

Source

Thrown at upup/pkg/fi/files_owner.go:46

// EnsureFileOwner will set the owner & group for a file.
// Empty values for owner/group will leave the owner/group unchanged.
func EnsureFileOwner(destPath string, owner string, groupName string) (bool, error) {
	changed := false
	stat, err := os.Lstat(destPath)
	if err != nil {
		return changed, fmt.Errorf("error getting file stat for %q: %v", destPath, err)
	}

	actualUserID := int(stat.Sys().(*syscall.Stat_t).Uid)
	userID := actualUserID
	if owner != "" {
		user, err := LookupUser(owner) // user.Lookup(owner)
		if err != nil {
			return changed, fmt.Errorf("error looking up user %q: %v", owner, err)
		}
		if user == nil {
			return changed, fmt.Errorf("user %q not found", owner)
		}
		userID = user.Uid
	}

	actualGroupID := int(stat.Sys().(*syscall.Stat_t).Gid)
	groupID := actualGroupID
	if groupName != "" {
		group, err := LookupGroup(groupName)
		if err != nil {
			return changed, fmt.Errorf("error looking up group %q: %v", groupName, err)
		}
		if group == nil {
			return changed, fmt.Errorf("group %q not found", groupName)
		}
		groupID = group.Gid
	}

	if actualUserID == userID && actualGroupID == groupID {

View on GitHub (pinned to 4c8573c808)

Solutions

Create the missing user on the host, e.g. `sudo useradd <name>`
Fix the owner field in the file task/spec to an existing username
Verify with `id <name>` or `getent passwd <name>` that the user resolves locally
If ownership should be left unchanged, set owner to empty string

Example fix

// before (spec)
owner: "kopsadmin"
// after (user created or corrected)
sudo useradd kopsadmin  # or owner: "" to skip ownership change

Defensive patterns

Strategy: validation

Validate before calling

if _, err := user.Lookup(owner); err != nil { return fmt.Errorf("user %q does not exist on this host; create it or clear the owner field", owner) }

Try / catch

if _, err := ensureFileOwner(path, owner, group); err != nil { if strings.Contains(err.Error(), "not found") { /* fall back to default owner or skip */ } else { return err } }

Prevention

Run `getent passwd <owner>` in CI before rendering assets
Document required local users for kOps asset rendering
Prefer empty owner field when ownership management is not needed

When it happens

Trigger: Calling RenderLocal on a file task whose owner field names a user that does not exist on the local host; LookupUser(owner) succeeds without error but returns nil.

Common situations: Cluster spec references a service user (e.g. 'kube') that was never created on the build/admin machine; running kOps in a minimal or containerized environment missing system users; typo in the owner field of a file asset.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/30be7100cdf9268f. Report an issue: GitHub.