What causes "writing private bundle: %v" in kubernetes/kops?

Verify the destination VFS path exists and credentials have write permissions there.

writing private bundle: %v

Error message

writing private bundle: %v

What it means

mirrorKeyset writes a keyset bundle (certificates/privatekeys) into the mirror's "private" directory via writeKeysetBundle. Any failure in that write — serialization errors, ACL resolution failures, or VFS write errors to the destination — is wrapped as "writing private bundle".

Source

Thrown at upup/pkg/fi/vfs_castore.go:231

	sshCredentials, err := c.FindSSHPublicKeys()
	if err != nil {
		return fmt.Errorf("error listing SSHCredentials: %v", err)
	}

	for _, sshCredential := range sshCredentials {
		if err := mirrorSSHCredential(ctx, c.cluster, basedir, sshCredential); err != nil {
			return err
		}
	}

	return nil
}

// mirrorKeyset writes Keyset bundles for the certificates & privatekeys.
func mirrorKeyset(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, name string, keyset *Keyset) error {
	if err := writeKeysetBundle(ctx, cluster, basedir.Join("private"), name, keyset); err != nil {
		return fmt.Errorf("writing private bundle: %v", err)
	}

	return nil
}

// mirrorSSHCredential writes the SSH credential file to the mirror location
func mirrorSSHCredential(ctx context.Context, cluster *kops.Cluster, basedir vfs.Path, sshCredential *kops.SSHCredential) error {
	id, err := sshcredentials.Fingerprint(sshCredential.Spec.PublicKey)
	if err != nil {
		return fmt.Errorf("error fingerprinting SSH public key %q: %v", sshCredential.Name, err)
	}

	p := basedir.Join("ssh", "public", sshCredential.Name, id)
	acl, err := acls.GetACL(ctx, p, cluster)
	if err != nil {
		return err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Verify the destination VFS path exists and credentials have write permissions there.
Check the wrapped inner error to distinguish ACL failure vs serialization failure and fix accordingly.
Ensure the target cluster's ACL configuration (acls.GetACL) is valid for the destination provider.
Retry the mirror; if throttling or transient storage errors occur, back off and re-run.

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify destination is writable before mirroring
probe := dest.Join(".kops-mirror-probe")
if err := probe.WriteFile(context.TODO(), []byte("ok"), nil); err != nil {
	return fmt.Errorf("destination not writable: %w", err)
}

Try / catch

if err := writeKeysetBundle(ctx, cluster, basedir, name, keyset); err != nil {
	return fmt.Errorf("writing private bundle for %q: %w — check destination permissions and ACL config", name, err)
}

Prevention

Create and permission the destination bucket/path before the first mirror.
Verify the destination cluster ACL configuration matches the provider.
Run a dry-run mirror with a small keyset to validate the pipeline.

When it happens

Trigger: MirrorTo -> mirrorKeyset when the destination store rejects the write: destination bucket missing/readonly, GetACL failure on the mirror path, or the underlying encode (error serializing keyset) failed.

Common situations: Mirroring to a new bucket that has not been created or lacks write IAM; destination ACL config incompatible with the cluster's ACL rules; disk/full or throttled storage backends.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/87a5d2ae1884e34d. Report an issue: GitHub.