diff --git a/cmd/kops/create.go b/cmd/kops/create.go
index 9b57604a22e6f..a2931d937da67 100644
--- a/cmd/kops/create.go
+++ b/cmd/kops/create.go
@@ -141,7 +141,7 @@ func RunCreate(ctx context.Context, f *util.Factory, out io.Writer, c *CreateOpt
 
 				// Adding a PerformAssignments() call here as the user might be trying to use
 				// the new `-f` feature, with an old cluster definition.
-				err = cloudup.PerformAssignments(v, cloud)
+				err = cloudup.PerformAssignments(v, vfsContext, cloud)
 				if err != nil {
 					return fmt.Errorf("error populating configuration: %v", err)
 				}
diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go
index 360a0056e15ea..df717e06686c8 100644
--- a/cmd/kops/create_cluster.go
+++ b/cmd/kops/create_cluster.go
@@ -645,13 +645,13 @@ func RunCreateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *Cr
 		return err
 	}
 
-	err = cloudup.PerformAssignments(cluster, cloud)
+	err = cloudup.PerformAssignments(cluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return fmt.Errorf("error populating configuration: %v", err)
 	}
 
 	strict := false
-	err = validation.DeepValidate(cluster, instanceGroups, strict, nil)
+	err = validation.DeepValidate(cluster, instanceGroups, strict, clientset.VFSContext(), nil)
 	if err != nil {
 		return err
 	}
@@ -691,7 +691,7 @@ func RunCreateCluster(ctx context.Context, f *util.Factory, out io.Writer, c *Cr
 			fullInstanceGroups = append(fullInstanceGroups, fullGroup)
 		}
 
-		err = validation.DeepValidate(fullCluster, fullInstanceGroups, true, nil)
+		err = validation.DeepValidate(fullCluster, fullInstanceGroups, true, clientset.VFSContext(), nil)
 		if err != nil {
 			return fmt.Errorf("validation of the full cluster and instance group specs failed: %w", err)
 		}
diff --git a/cmd/kops/create_instancegroup.go b/cmd/kops/create_instancegroup.go
index 1a95365c00f80..d77ac6f5c80dc 100644
--- a/cmd/kops/create_instancegroup.go
+++ b/cmd/kops/create_instancegroup.go
@@ -159,7 +159,7 @@ func RunCreateInstanceGroup(ctx context.Context, f *util.Factory, out io.Writer,
 		return err
 	}
 
-	channel, err := cloudup.ChannelForCluster(cluster)
+	channel, err := cloudup.ChannelForCluster(clientset.VFSContext(), cluster)
 	if err != nil {
 		klog.Warningf("%v", err)
 	}
diff --git a/cmd/kops/edit_cluster.go b/cmd/kops/edit_cluster.go
index 8e2038c2804ca..6cbc3a68e925e 100644
--- a/cmd/kops/edit_cluster.go
+++ b/cmd/kops/edit_cluster.go
@@ -255,7 +255,7 @@ func updateCluster(ctx context.Context, clientset simple.Clientset, oldCluster,
 		return "", err
 	}
 
-	err = cloudup.PerformAssignments(newCluster, cloud)
+	err = cloudup.PerformAssignments(newCluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return "", fmt.Errorf("error populating configuration: %v", err)
 	}
@@ -266,7 +266,7 @@ func updateCluster(ctx context.Context, clientset simple.Clientset, oldCluster,
 		return fmt.Sprintf("error populating cluster spec: %s", err), nil
 	}
 
-	err = validation.DeepValidate(fullCluster, instanceGroups, true, cloud)
+	err = validation.DeepValidate(fullCluster, instanceGroups, true, clientset.VFSContext(), cloud)
 	if err != nil {
 		return fmt.Sprintf("validation failed: %s", err), nil
 	}
diff --git a/cmd/kops/edit_instancegroup.go b/cmd/kops/edit_instancegroup.go
index b20a37572b983..9f45c8a92f8c3 100644
--- a/cmd/kops/edit_instancegroup.go
+++ b/cmd/kops/edit_instancegroup.go
@@ -127,14 +127,14 @@ func RunEditInstanceGroup(ctx context.Context, f *util.Factory, out io.Writer, o
 		return err
 	}
 
-	channel, err := cloudup.ChannelForCluster(cluster)
+	clientset, err := f.KopsClient()
 	if err != nil {
-		klog.Warningf("%v", err)
+		return err
 	}
 
-	clientset, err := f.KopsClient()
+	channel, err := cloudup.ChannelForCluster(clientset.VFSContext(), cluster)
 	if err != nil {
-		return err
+		klog.Warningf("%v", err)
 	}
 
 	oldGroup, err := clientset.InstanceGroupsFor(cluster).Get(ctx, groupName, metav1.GetOptions{})
@@ -290,7 +290,7 @@ func updateInstanceGroup(ctx context.Context, clientset simple.Clientset, channe
 
 	// We need the full cluster spec to perform deep validation
 	// Note that we don't write it back though
-	err = cloudup.PerformAssignments(cluster, cloud)
+	err = cloudup.PerformAssignments(cluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return "", fmt.Errorf("error populating configuration: %v", err)
 	}
diff --git a/cmd/kops/get_cluster.go b/cmd/kops/get_cluster.go
index 57d8e5e254e42..60fbdab16fa98 100644
--- a/cmd/kops/get_cluster.go
+++ b/cmd/kops/get_cluster.go
@@ -33,6 +33,7 @@ import (
 	"k8s.io/kops/pkg/commands/commandutils"
 	"k8s.io/kops/pkg/kopscodecs"
 	"k8s.io/kops/util/pkg/tables"
+	"k8s.io/kops/util/pkg/vfs"
 	"k8s.io/kubectl/pkg/util/i18n"
 	"k8s.io/kubectl/pkg/util/templates"
 )
@@ -157,7 +158,7 @@ func RunGetClusters(ctx context.Context, f commandutils.Factory, out io.Writer,
 
 	if options.FullSpec {
 		var err error
-		clusters, err = fullClusterSpecs(ctx, clusters)
+		clusters, err = fullClusterSpecs(ctx, client.VFSContext(), clusters)
 		if err != nil {
 			return err
 		}
@@ -278,10 +279,10 @@ func fullOutputYAML(out io.Writer, args ...runtime.Object) error {
 	return nil
 }
 
-func fullClusterSpecs(ctx context.Context, clusters []*kopsapi.Cluster) ([]*kopsapi.Cluster, error) {
+func fullClusterSpecs(ctx context.Context, vfsContext *vfs.VFSContext, clusters []*kopsapi.Cluster) ([]*kopsapi.Cluster, error) {
 	var fullSpecs []*kopsapi.Cluster
 	for _, cluster := range clusters {
-		configBase, err := registry.ConfigBase(cluster)
+		configBase, err := registry.ConfigBase(vfsContext, cluster)
 		if err != nil {
 			return nil, fmt.Errorf("error reading full cluster spec for %q: %v", cluster.ObjectMeta.Name, err)
 		}
diff --git a/cmd/kops/replace.go b/cmd/kops/replace.go
index dedb007d61a65..802abc1092466 100644
--- a/cmd/kops/replace.go
+++ b/cmd/kops/replace.go
@@ -140,7 +140,7 @@ func RunReplace(ctx context.Context, f *util.Factory, out io.Writer, c *ReplaceO
 							return fmt.Errorf("cluster %v does not exist (try adding --force flag)", clusterName)
 						}
 
-						err = cloudup.PerformAssignments(v, cloud)
+						err = cloudup.PerformAssignments(v, vfsContext, cloud)
 						if err != nil {
 							return fmt.Errorf("error populating configuration: %w", err)
 						}
diff --git a/cmd/kops/toolbox_instance-selector.go b/cmd/kops/toolbox_instance-selector.go
index b03f671dd2300..d08a56c585237 100644
--- a/cmd/kops/toolbox_instance-selector.go
+++ b/cmd/kops/toolbox_instance-selector.go
@@ -384,7 +384,7 @@ func retrieveClusterRefs(ctx context.Context, f commandutils.Factory, clusterNam
 		return nil, nil, nil, err
 	}
 
-	channel, err := cloudup.ChannelForCluster(cluster)
+	channel, err := cloudup.ChannelForCluster(clientset.VFSContext(), cluster)
 	if err != nil {
 		return nil, nil, nil, err
 	}
diff --git a/cmd/kops/toolbox_template.go b/cmd/kops/toolbox_template.go
index 98fbb6c3ce5e8..db4e1f84bc86b 100644
--- a/cmd/kops/toolbox_template.go
+++ b/cmd/kops/toolbox_template.go
@@ -173,7 +173,7 @@ func RunToolBoxTemplate(f commandutils.Factory, out io.Writer, options *ToolboxT
 		}
 	}
 
-	channel, err := kopsapi.LoadChannel(options.channel)
+	channel, err := kopsapi.LoadChannel(f.VFSContext(), options.channel)
 	if err != nil {
 		return fmt.Errorf("error loading channel %q: %v", options.channel, err)
 	}
diff --git a/cmd/kops/upgrade_cluster.go b/cmd/kops/upgrade_cluster.go
index cc08ba67091a6..6583df0404aa3 100644
--- a/cmd/kops/upgrade_cluster.go
+++ b/cmd/kops/upgrade_cluster.go
@@ -138,7 +138,7 @@ func RunUpgradeCluster(ctx context.Context, f *util.Factory, out io.Writer, opti
 		})
 	}
 
-	channel, err := kopsapi.LoadChannel(channelLocation)
+	channel, err := kopsapi.LoadChannel(f.VFSContext(), channelLocation)
 	if err != nil {
 		return fmt.Errorf("error loading channel %q: %v", channelLocation, err)
 	}
diff --git a/examples/kops-api-example/up.go b/examples/kops-api-example/up.go
index 6f9719fbdaa6b..a308cb8c0de41 100644
--- a/examples/kops-api-example/up.go
+++ b/examples/kops-api-example/up.go
@@ -76,7 +76,7 @@ func up(vfsContext *vfs.VFSContext, ctx context.Context) error {
 		return err
 	}
 
-	if err := cloudup.PerformAssignments(cluster, cloud); err != nil {
+	if err := cloudup.PerformAssignments(cluster, vfsContext, cloud); err != nil {
 		return err
 	}
 
diff --git a/nodeup/pkg/model/kubelet_test.go b/nodeup/pkg/model/kubelet_test.go
index d9da201b7ce71..a74dd4a735544 100644
--- a/nodeup/pkg/model/kubelet_test.go
+++ b/nodeup/pkg/model/kubelet_test.go
@@ -249,7 +249,7 @@ func BuildNodeupModelContext(model *testutils.Model) (*NodeupModelContext, error
 		return nil, fmt.Errorf("error from BuildCloud: %v", err)
 	}
 
-	err = cloudup.PerformAssignments(model.Cluster, cloud)
+	err = cloudup.PerformAssignments(model.Cluster, vfs.Context, cloud)
 	if err != nil {
 		return nil, fmt.Errorf("error from PerformAssignments: %v", err)
 	}
diff --git a/pkg/apis/kops/channel.go b/pkg/apis/kops/channel.go
index 1817bb4a4c107..43d2c4ad3e0a2 100644
--- a/pkg/apis/kops/channel.go
+++ b/pkg/apis/kops/channel.go
@@ -128,7 +128,7 @@ func ResolveChannel(location string) (*url.URL, error) {
 }
 
 // LoadChannel loads a Channel object from the specified VFS location
-func LoadChannel(location string) (*Channel, error) {
+func LoadChannel(vfsContext *vfs.VFSContext, location string) (*Channel, error) {
 	resolvedURL, err := ResolveChannel(location)
 	if err != nil {
 		return nil, err
@@ -141,7 +141,7 @@ func LoadChannel(location string) (*Channel, error) {
 	resolved := resolvedURL.String()
 
 	klog.V(2).Infof("Loading channel from %q", resolved)
-	channelBytes, err := vfs.Context.ReadFile(resolved)
+	channelBytes, err := vfsContext.ReadFile(resolved)
 	if err != nil {
 		return nil, fmt.Errorf("error reading channel %q: %v", resolved, err)
 	}
diff --git a/pkg/apis/kops/registry/registry.go b/pkg/apis/kops/registry/registry.go
index f5f4960f07e81..4ebea03d05db3 100644
--- a/pkg/apis/kops/registry/registry.go
+++ b/pkg/apis/kops/registry/registry.go
@@ -33,11 +33,11 @@ const (
 	PathKopsVersionUpdated = "kops-version.txt"
 )
 
-func ConfigBase(c *api.Cluster) (vfs.Path, error) {
+func ConfigBase(vfsContext *vfs.VFSContext, c *api.Cluster) (vfs.Path, error) {
 	if c.Spec.ConfigBase == "" {
 		return nil, field.Required(field.NewPath("spec", "configBase"), "")
 	}
-	configBase, err := vfs.Context.BuildVfsPath(c.Spec.ConfigBase)
+	configBase, err := vfsContext.BuildVfsPath(c.Spec.ConfigBase)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing ConfigBase %q: %v", c.Spec.ConfigBase, err)
 	}
diff --git a/pkg/apis/kops/validation/cluster.go b/pkg/apis/kops/validation/cluster.go
index 91680a4b33860..e94bc369fa0c3 100644
--- a/pkg/apis/kops/validation/cluster.go
+++ b/pkg/apis/kops/validation/cluster.go
@@ -23,10 +23,11 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/util/pkg/vfs"
 )
 
-func ValidateClusterUpdate(obj *kops.Cluster, status *kops.ClusterStatus, old *kops.Cluster) field.ErrorList {
-	allErrs := ValidateCluster(obj, false)
+func ValidateClusterUpdate(obj *kops.Cluster, status *kops.ClusterStatus, old *kops.Cluster, vfsContext *vfs.VFSContext) field.ErrorList {
+	allErrs := ValidateCluster(obj, false, vfsContext)
 
 	// Validate etcd cluster changes
 	{
diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go
index 172ef61af9b66..9338cb0884d53 100644
--- a/pkg/apis/kops/validation/legacy.go
+++ b/pkg/apis/kops/validation/legacy.go
@@ -33,7 +33,7 @@ import (
 // legacy contains validation functions that don't match the apimachinery style
 
 // ValidateCluster is responsible for checking the validity of the Cluster spec
-func ValidateCluster(c *kops.Cluster, strict bool) field.ErrorList {
+func ValidateCluster(c *kops.Cluster, strict bool, vfsContext *vfs.VFSContext) field.ErrorList {
 	fieldSpec := field.NewPath("spec")
 	allErrs := field.ErrorList{}
 
@@ -200,12 +200,12 @@ func ValidateCluster(c *kops.Cluster, strict bool) field.ErrorList {
 	allErrs = append(allErrs, newValidateCluster(c, strict)...)
 
 	said := c.Spec.ServiceAccountIssuerDiscovery
-	allErrs = append(allErrs, validateServiceAccountIssuerDiscovery(c, said, fieldSpec.Child("serviceAccountIssuerDiscovery"))...)
+	allErrs = append(allErrs, validateServiceAccountIssuerDiscovery(c, said, fieldSpec.Child("serviceAccountIssuerDiscovery"), vfsContext)...)
 
 	return allErrs
 }
 
-func validateServiceAccountIssuerDiscovery(c *kops.Cluster, said *kops.ServiceAccountIssuerDiscoveryConfig, fieldSpec *field.Path) field.ErrorList {
+func validateServiceAccountIssuerDiscovery(c *kops.Cluster, said *kops.ServiceAccountIssuerDiscoveryConfig, fieldSpec *field.Path, vfsContext *vfs.VFSContext) field.ErrorList {
 	if said == nil {
 		return nil
 	}
@@ -213,7 +213,7 @@ func validateServiceAccountIssuerDiscovery(c *kops.Cluster, said *kops.ServiceAc
 	saidStore := said.DiscoveryStore
 	if saidStore != "" {
 		saidStoreField := fieldSpec.Child("serviceAccountIssuerDiscovery", "discoveryStore")
-		base, err := vfs.Context.BuildVfsPath(saidStore)
+		base, err := vfsContext.BuildVfsPath(saidStore)
 		if err != nil {
 			allErrs = append(allErrs, field.Invalid(saidStoreField, saidStore, "not a valid VFS path"))
 		} else {
@@ -256,8 +256,8 @@ func validateSubnetCIDR(networkCIDRs []*net.IPNet, subnetCIDR *net.IPNet) bool {
 }
 
 // DeepValidate is responsible for validating the instancegroups within the cluster spec
-func DeepValidate(c *kops.Cluster, groups []*kops.InstanceGroup, strict bool, cloud fi.Cloud) error {
-	if errs := ValidateCluster(c, strict); len(errs) != 0 {
+func DeepValidate(c *kops.Cluster, groups []*kops.InstanceGroup, strict bool, vfsContext *vfs.VFSContext, cloud fi.Cloud) error {
+	if errs := ValidateCluster(c, strict, vfsContext); len(errs) != 0 {
 		return errs.ToAggregate()
 	}
 
diff --git a/pkg/client/simple/api/clientset.go b/pkg/client/simple/api/clientset.go
index 85c27b85f8d02..050f1c103a679 100644
--- a/pkg/client/simple/api/clientset.go
+++ b/pkg/client/simple/api/clientset.go
@@ -81,7 +81,7 @@ func (c *RESTClientset) UpdateCluster(ctx context.Context, cluster *kops.Cluster
 	if err != nil {
 		return nil, err
 	}
-	if err := validation.ValidateClusterUpdate(cluster, status, old).ToAggregate(); err != nil {
+	if err := validation.ValidateClusterUpdate(cluster, status, old, c.VFSContext()).ToAggregate(); err != nil {
 		return nil, err
 	}
 
@@ -126,7 +126,7 @@ func (c *RESTClientset) SSHCredentialStore(cluster *kops.Cluster) (fi.SSHCredent
 }
 
 func (c *RESTClientset) DeleteCluster(ctx context.Context, cluster *kops.Cluster) error {
-	configBase, err := registry.ConfigBase(cluster)
+	configBase, err := registry.ConfigBase(c.VFSContext(), cluster)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/client/simple/vfsclientset/clientset.go b/pkg/client/simple/vfsclientset/clientset.go
index 6b85ed90dddac..f92edba4581eb 100644
--- a/pkg/client/simple/vfsclientset/clientset.go
+++ b/pkg/client/simple/vfsclientset/clientset.go
@@ -45,7 +45,7 @@ func (c *VFSClientset) VFSContext() *vfs.VFSContext {
 }
 
 func (c *VFSClientset) clusters() *ClusterVFS {
-	return newClusterVFS(c.basePath)
+	return newClusterVFS(c.VFSContext(), c.basePath)
 }
 
 // GetCluster implements the GetCluster method of simple.Clientset for a VFS-backed state store
@@ -87,7 +87,7 @@ func (c *VFSClientset) AddonsFor(cluster *kops.Cluster) simple.AddonsClient {
 
 func (c *VFSClientset) SecretStore(cluster *kops.Cluster) (fi.SecretStore, error) {
 	if cluster.Spec.SecretStore == "" {
-		configBase, err := registry.ConfigBase(cluster)
+		configBase, err := registry.ConfigBase(c.VFSContext(), cluster)
 		if err != nil {
 			return nil, err
 		}
@@ -120,7 +120,7 @@ func (c *VFSClientset) SSHCredentialStore(cluster *kops.Cluster) (fi.SSHCredenti
 
 func (c *VFSClientset) pkiPath(cluster *kops.Cluster) (vfs.Path, error) {
 	if cluster.Spec.KeyStore == "" {
-		configBase, err := registry.ConfigBase(cluster)
+		configBase, err := registry.ConfigBase(c.VFSContext(), cluster)
 		if err != nil {
 			return nil, err
 		}
@@ -232,7 +232,7 @@ func (c *VFSClientset) DeleteCluster(ctx context.Context, cluster *kops.Cluster)
 		}
 	}
 
-	configBase, err := registry.ConfigBase(cluster)
+	configBase, err := registry.ConfigBase(c.VFSContext(), cluster)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/client/simple/vfsclientset/cluster.go b/pkg/client/simple/vfsclientset/cluster.go
index 27a1da5f7dd82..a4e1937331966 100644
--- a/pkg/client/simple/vfsclientset/cluster.go
+++ b/pkg/client/simple/vfsclientset/cluster.go
@@ -41,9 +41,9 @@ type ClusterVFS struct {
 	commonVFS
 }
 
-func newClusterVFS(basePath vfs.Path) *ClusterVFS {
+func newClusterVFS(vfsContext *vfs.VFSContext, basePath vfs.Path) *ClusterVFS {
 	c := &ClusterVFS{}
-	c.init("Cluster", basePath, StoreVersion)
+	c.init("Cluster", vfsContext, basePath, StoreVersion)
 	return c
 }
 
@@ -103,7 +103,7 @@ func (c *ClusterVFS) List(options metav1.ListOptions) (*api.ClusterList, error)
 func (r *ClusterVFS) Create(c *api.Cluster) (*api.Cluster, error) {
 	ctx := context.TODO()
 
-	if errs := validation.ValidateCluster(c, false); len(errs) != 0 {
+	if errs := validation.ValidateCluster(c, false, r.vfsContext); len(errs) != 0 {
 		return nil, errs.ToAggregate()
 	}
 
@@ -143,7 +143,7 @@ func (r *ClusterVFS) Update(c *api.Cluster, status *api.ClusterStatus) (*api.Clu
 		return nil, errors.NewNotFound(schema.GroupResource{Group: api.GroupName, Resource: "Cluster"}, clusterName)
 	}
 
-	if err := validation.ValidateClusterUpdate(c, status, old).ToAggregate(); err != nil {
+	if err := validation.ValidateClusterUpdate(c, status, old, r.vfsContext).ToAggregate(); err != nil {
 		return nil, err
 	}
 
diff --git a/pkg/client/simple/vfsclientset/commonvfs.go b/pkg/client/simple/vfsclientset/commonvfs.go
index fe3d074940bb9..cfbf119ac6ec6 100644
--- a/pkg/client/simple/vfsclientset/commonvfs.go
+++ b/pkg/client/simple/vfsclientset/commonvfs.go
@@ -41,13 +41,14 @@ var StoreVersion = v1alpha2.SchemeGroupVersion
 type ValidationFunction func(o runtime.Object) error
 
 type commonVFS struct {
-	kind     string
-	basePath vfs.Path
-	encoder  runtime.Encoder
-	validate ValidationFunction
+	kind       string
+	vfsContext *vfs.VFSContext
+	basePath   vfs.Path
+	encoder    runtime.Encoder
+	validate   ValidationFunction
 }
 
-func (c *commonVFS) init(kind string, basePath vfs.Path, storeVersion runtime.GroupVersioner) {
+func (c *commonVFS) init(kind string, vfsContext *vfs.VFSContext, basePath vfs.Path, storeVersion runtime.GroupVersioner) {
 	codecs := kopscodecs.Codecs
 	yaml, ok := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), "application/yaml")
 	if !ok {
@@ -56,6 +57,7 @@ func (c *commonVFS) init(kind string, basePath vfs.Path, storeVersion runtime.Gr
 	c.encoder = codecs.EncoderForVersion(yaml.Serializer, storeVersion)
 
 	c.kind = kind
+	c.vfsContext = vfsContext
 	c.basePath = basePath
 }
 
diff --git a/pkg/client/simple/vfsclientset/instancegroup.go b/pkg/client/simple/vfsclientset/instancegroup.go
index ce02c086a38c7..0fbae1d8ae05a 100644
--- a/pkg/client/simple/vfsclientset/instancegroup.go
+++ b/pkg/client/simple/vfsclientset/instancegroup.go
@@ -52,7 +52,7 @@ func newInstanceGroupVFS(c *VFSClientset, cluster *kopsapi.Cluster) *InstanceGro
 		cluster:     cluster,
 		clusterName: clusterName,
 	}
-	r.init(kind, c.basePath.Join(clusterName, "instancegroup"), StoreVersion)
+	r.init(kind, c.VFSContext(), c.basePath.Join(clusterName, "instancegroup"), StoreVersion)
 	r.validate = func(o runtime.Object) error {
 		return validation.ValidateInstanceGroup(o.(*kopsapi.InstanceGroup), nil, false).ToAggregate()
 	}
diff --git a/pkg/commands/commandutils/factory.go b/pkg/commands/commandutils/factory.go
index 3399742d40e2d..59c331ddc54ea 100644
--- a/pkg/commands/commandutils/factory.go
+++ b/pkg/commands/commandutils/factory.go
@@ -16,8 +16,12 @@ limitations under the License.
 
 package commandutils
 
-import "k8s.io/kops/pkg/client/simple"
+import (
+	"k8s.io/kops/pkg/client/simple"
+	"k8s.io/kops/util/pkg/vfs"
+)
 
 type Factory interface {
 	KopsClient() (simple.Clientset, error)
+	VFSContext() *vfs.VFSContext
 }
diff --git a/pkg/commands/helpers_readwrite.go b/pkg/commands/helpers_readwrite.go
index bfb102d5598bd..a00365b903488 100644
--- a/pkg/commands/helpers_readwrite.go
+++ b/pkg/commands/helpers_readwrite.go
@@ -35,7 +35,7 @@ func UpdateCluster(ctx context.Context, clientset simple.Clientset, cluster *kop
 		return err
 	}
 
-	err = cloudup.PerformAssignments(cluster, cloud)
+	err = cloudup.PerformAssignments(cluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return fmt.Errorf("error populating configuration: %v", err)
 	}
@@ -46,7 +46,7 @@ func UpdateCluster(ctx context.Context, clientset simple.Clientset, cluster *kop
 		return err
 	}
 
-	err = validation.DeepValidate(fullCluster, instanceGroups, true, nil)
+	err = validation.DeepValidate(fullCluster, instanceGroups, true, clientset.VFSContext(), nil)
 	if err != nil {
 		return err
 	}
@@ -73,7 +73,7 @@ func UpdateInstanceGroup(ctx context.Context, clientset simple.Clientset, cluste
 		return err
 	}
 
-	err = cloudup.PerformAssignments(cluster, cloud)
+	err = cloudup.PerformAssignments(cluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return fmt.Errorf("error populating configuration: %v", err)
 	}
diff --git a/pkg/instancegroups/rollingupdate_os_test.go b/pkg/instancegroups/rollingupdate_os_test.go
index 6578353f48abf..8012867662b45 100644
--- a/pkg/instancegroups/rollingupdate_os_test.go
+++ b/pkg/instancegroups/rollingupdate_os_test.go
@@ -53,7 +53,7 @@ func getTestSetupOS(t *testing.T, ctx context.Context) (*RollingUpdateCluster, *
 	inCluster.Spec.Networking.Topology.ControlPlane = kopsapi.TopologyPrivate
 	inCluster.Spec.Networking.Topology.Nodes = kopsapi.TopologyPrivate
 
-	err := cloudup.PerformAssignments(inCluster, mockcloud)
+	err := cloudup.PerformAssignments(inCluster, vfs.Context, mockcloud)
 	if err != nil {
 		t.Fatalf("Failed to perform assignments: %v", err)
 	}
diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
index 97f5f7487268d..fa54f2bde73db 100644
--- a/upup/pkg/fi/cloudup/apply_cluster.go
+++ b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -208,7 +208,7 @@ func (c *ApplyClusterCmd) Run(ctx context.Context) error {
 		}
 	}
 
-	channel, err := ChannelForCluster(c.Cluster)
+	channel, err := ChannelForCluster(c.Clientset.VFSContext(), c.Cluster)
 	if err != nil {
 		klog.Warningf("%v", err)
 	}
@@ -297,7 +297,7 @@ func (c *ApplyClusterCmd) Run(ctx context.Context) error {
 
 	cloud := c.Cloud
 
-	err = validation.DeepValidate(c.Cluster, c.InstanceGroups, true, cloud)
+	err = validation.DeepValidate(c.Cluster, c.InstanceGroups, true, c.Clientset.VFSContext(), cloud)
 	if err != nil {
 		return err
 	}
@@ -1136,12 +1136,12 @@ func buildPermalink(key, anchor string) string {
 	return url
 }
 
-func ChannelForCluster(c *kops.Cluster) (*kops.Channel, error) {
+func ChannelForCluster(vfsContext *vfs.VFSContext, c *kops.Cluster) (*kops.Channel, error) {
 	channelLocation := c.Spec.Channel
 	if channelLocation == "" {
 		channelLocation = kops.DefaultChannel
 	}
-	return kops.LoadChannel(channelLocation)
+	return kops.LoadChannel(vfsContext, channelLocation)
 }
 
 // needsMounterAsset checks if we need the mounter program
diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder_test.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder_test.go
index e36dcf7f92449..c12d40fef029e 100644
--- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder_test.go
+++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder_test.go
@@ -101,7 +101,7 @@ func runChannelBuilderTest(t *testing.T, key string, addonManifests []string) {
 		t.Fatalf("error from BuildCloud: %v", err)
 	}
 
-	if err := PerformAssignments(cluster, cloud); err != nil {
+	if err := PerformAssignments(cluster, vfs.Context, cloud); err != nil {
 		t.Fatalf("error from PerformAssignments for %q: %v", key, err)
 	}
 
diff --git a/upup/pkg/fi/cloudup/deepvalidate_test.go b/upup/pkg/fi/cloudup/deepvalidate_test.go
index 22e5ac0873fdc..d1d36f42d614f 100644
--- a/upup/pkg/fi/cloudup/deepvalidate_test.go
+++ b/upup/pkg/fi/cloudup/deepvalidate_test.go
@@ -24,6 +24,7 @@ import (
 	kopsapi "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/apis/kops/validation"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/util/pkg/vfs"
 )
 
 func TestDeepValidate_OK(t *testing.T) {
@@ -33,7 +34,7 @@ func TestDeepValidate_OK(t *testing.T) {
 		groups = append(groups, buildMinimalMasterInstanceGroup(subnet.Name))
 		groups = append(groups, buildMinimalNodeInstanceGroup(subnet.Name))
 	}
-	err := validation.DeepValidate(c, groups, true, nil)
+	err := validation.DeepValidate(c, groups, true, vfs.Context, nil)
 	if err != nil {
 		t.Fatalf("Expected no error from DeepValidate, got %v", err)
 	}
@@ -174,7 +175,7 @@ func TestDeepValidate_MissingEtcdMember(t *testing.T) {
 }
 
 func expectErrorFromDeepValidate(t *testing.T, c *kopsapi.Cluster, groups []*kopsapi.InstanceGroup, message string) {
-	err := validation.DeepValidate(c, groups, true, nil)
+	err := validation.DeepValidate(c, groups, true, vfs.Context, nil)
 	if err == nil {
 		t.Fatalf("Expected error %q from DeepValidate (strict=true), not no error raised", message)
 	}
diff --git a/upup/pkg/fi/cloudup/defaults.go b/upup/pkg/fi/cloudup/defaults.go
index a2fd691537255..a4e36b997126b 100644
--- a/upup/pkg/fi/cloudup/defaults.go
+++ b/upup/pkg/fi/cloudup/defaults.go
@@ -40,7 +40,7 @@ import (
 // PerformAssignments is called on create, as well as an update. In fact
 // any time Run() is called in apply_cluster.go we will reach this function.
 // Please do all after-market logic here.
-func PerformAssignments(c *kops.Cluster, cloud fi.Cloud) error {
+func PerformAssignments(c *kops.Cluster, vfsContext *vfs.VFSContext, cloud fi.Cloud) error {
 	ctx := context.TODO()
 
 	for i := range c.Spec.EtcdClusters {
@@ -133,15 +133,15 @@ func PerformAssignments(c *kops.Cluster, cloud fi.Cloud) error {
 	}
 	c.Spec.Networking.EgressProxy = proxy
 
-	return ensureKubernetesVersion(c)
+	return ensureKubernetesVersion(vfsContext, c)
 }
 
 // ensureKubernetesVersion populates KubernetesVersion, if it is not already set
 // It will be populated with the latest stable kubernetes version, or the version from the channel
-func ensureKubernetesVersion(c *kops.Cluster) error {
+func ensureKubernetesVersion(vfsContext *vfs.VFSContext, c *kops.Cluster) error {
 	if c.Spec.KubernetesVersion == "" {
 		if c.Spec.Channel != "" {
-			channel, err := kops.LoadChannel(c.Spec.Channel)
+			channel, err := kops.LoadChannel(vfsContext, c.Spec.Channel)
 			if err != nil {
 				return err
 			}
diff --git a/upup/pkg/fi/cloudup/new_cluster.go b/upup/pkg/fi/cloudup/new_cluster.go
index 55b139f03c78b..6c5435d41fba9 100644
--- a/upup/pkg/fi/cloudup/new_cluster.go
+++ b/upup/pkg/fi/cloudup/new_cluster.go
@@ -194,7 +194,7 @@ func NewCluster(opt *NewClusterOptions, clientset simple.Clientset) (*NewCluster
 	if opt.Channel == "" {
 		opt.Channel = api.DefaultChannel
 	}
-	channel, err := api.LoadChannel(opt.Channel)
+	channel, err := api.LoadChannel(clientset.VFSContext(), opt.Channel)
 	if err != nil {
 		return nil, err
 	}
diff --git a/upup/pkg/fi/cloudup/new_cluster_test.go b/upup/pkg/fi/cloudup/new_cluster_test.go
index ab979c141e264..c85f0115a2827 100644
--- a/upup/pkg/fi/cloudup/new_cluster_test.go
+++ b/upup/pkg/fi/cloudup/new_cluster_test.go
@@ -20,6 +20,7 @@ import (
 	"reflect"
 	"testing"
 
+	"k8s.io/kops/util/pkg/vfs"
 	"sigs.k8s.io/yaml"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -464,7 +465,7 @@ func TestDefaultImage(t *testing.T) {
 		},
 	}
 
-	channel, err := api.LoadChannel("file://tests/channels/channel.yaml")
+	channel, err := api.LoadChannel(vfs.NewTestingVFSContext(), "file://tests/channels/channel.yaml")
 	if err != nil {
 		t.Fatalf("unable to load test channel: %v", err)
 	}
diff --git a/upup/pkg/fi/cloudup/populate_cluster_spec.go b/upup/pkg/fi/cloudup/populate_cluster_spec.go
index 61e5e8e3f0136..42216755a6171 100644
--- a/upup/pkg/fi/cloudup/populate_cluster_spec.go
+++ b/upup/pkg/fi/cloudup/populate_cluster_spec.go
@@ -75,7 +75,7 @@ func PopulateClusterSpec(ctx context.Context, clientset simple.Clientset, cluste
 // struct is falling through..
 // @kris-nova
 func (c *populateClusterSpec) run(ctx context.Context, clientset simple.Clientset) error {
-	if errs := validation.ValidateCluster(c.InputCluster, false); len(errs) != 0 {
+	if errs := validation.ValidateCluster(c.InputCluster, false, clientset.VFSContext()); len(errs) != 0 {
 		return errs.ToAggregate()
 	}
 
@@ -96,7 +96,7 @@ func (c *populateClusterSpec) run(ctx context.Context, clientset simple.Clientse
 		return err
 	}
 
-	err = PerformAssignments(cluster, cloud)
+	err = PerformAssignments(cluster, clientset.VFSContext(), cloud)
 	if err != nil {
 		return err
 	}
@@ -314,7 +314,7 @@ func (c *populateClusterSpec) run(ctx context.Context, clientset simple.Clientse
 	*fullCluster = *cluster
 	fullCluster.Spec = *completed
 
-	if errs := validation.ValidateCluster(fullCluster, true); len(errs) != 0 {
+	if errs := validation.ValidateCluster(fullCluster, true, clientset.VFSContext()); len(errs) != 0 {
 		return fmt.Errorf("completed cluster failed validation: %v", errs.ToAggregate())
 	}
 
diff --git a/upup/pkg/fi/cloudup/populate_cluster_spec_test.go b/upup/pkg/fi/cloudup/populate_cluster_spec_test.go
index 3e9b737f7066a..af575ec6a5426 100644
--- a/upup/pkg/fi/cloudup/populate_cluster_spec_test.go
+++ b/upup/pkg/fi/cloudup/populate_cluster_spec_test.go
@@ -46,7 +46,7 @@ func TestPopulateCluster_Default_NoError(t *testing.T) {
 	ctx := context.TODO()
 	cloud, c := buildMinimalCluster()
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -95,7 +95,7 @@ func TestPopulateCluster_Subnets(t *testing.T) {
 				Enabled: fi.PtrTo(true),
 			}
 
-			err := PerformAssignments(c, cloud)
+			err := PerformAssignments(c, vfs.Context, cloud)
 			require.NoError(t, err, "PerformAssignments")
 
 			full, err := mockedPopulateClusterSpec(ctx, c, cloud)
@@ -131,7 +131,7 @@ func TestPopulateCluster_Docker_Spec(t *testing.T) {
 		LogOpt:             []string{"env=FOO"},
 	}
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -166,7 +166,7 @@ func TestPopulateCluster_StorageDefault(t *testing.T) {
 	ctx := context.TODO()
 	cloud, c := buildMinimalCluster()
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -185,7 +185,7 @@ func TestPopulateCluster_EvictionHard(t *testing.T) {
 	ctx := context.TODO()
 	cloud, c := buildMinimalCluster()
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -211,7 +211,7 @@ func build(c *kopsapi.Cluster) (*kopsapi.Cluster, error) {
 		return nil, fmt.Errorf("error from BuildCloud: %v", err)
 	}
 
-	err = PerformAssignments(c, cloud)
+	err = PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		return nil, fmt.Errorf("error from PerformAssignments: %v", err)
 	}
@@ -234,7 +234,7 @@ func TestPopulateCluster_Custom_CIDR(t *testing.T) {
 		{Name: "subnet-us-test-1c", Zone: "us-test-1c", CIDR: "172.20.2.64/27", Type: kopsapi.SubnetTypePublic},
 	}
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -253,7 +253,7 @@ func TestPopulateCluster_IsolateMasters(t *testing.T) {
 	cloud, c := buildMinimalCluster()
 	c.Spec.Networking.IsolateControlPlane = fi.PtrTo(true)
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -275,7 +275,7 @@ func TestPopulateCluster_IsolateMastersFalse(t *testing.T) {
 	cloud, c := buildMinimalCluster()
 	// default: c.Spec.IsolateControlPlane = fi.PtrTo(false)
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -386,7 +386,7 @@ func TestPopulateCluster_AnonymousAuth(t *testing.T) {
 	cloud, c := buildMinimalCluster()
 	c.Spec.KubernetesVersion = "1.20.0"
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -437,7 +437,7 @@ func TestPopulateCluster_KubeController_High_Enough_Version(t *testing.T) {
 	cloud, c := buildMinimalCluster()
 	c.Spec.KubernetesVersion = "v1.9.0"
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
diff --git a/upup/pkg/fi/cloudup/validation_test.go b/upup/pkg/fi/cloudup/validation_test.go
index d71a103be6917..4c70ecde488c4 100644
--- a/upup/pkg/fi/cloudup/validation_test.go
+++ b/upup/pkg/fi/cloudup/validation_test.go
@@ -26,6 +26,7 @@ import (
 	api "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/apis/kops/validation"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/util/pkg/vfs"
 )
 
 const testAWSRegion = "us-test-1"
@@ -34,7 +35,7 @@ func buildDefaultCluster(t *testing.T) *api.Cluster {
 	ctx := context.TODO()
 	cloud, c := buildMinimalCluster()
 
-	err := PerformAssignments(c, cloud)
+	err := PerformAssignments(c, vfs.Context, cloud)
 	if err != nil {
 		t.Fatalf("error from PerformAssignments: %v", err)
 	}
@@ -85,11 +86,11 @@ func buildDefaultCluster(t *testing.T) *api.Cluster {
 
 func TestValidateFull_Default_Validates(t *testing.T) {
 	c := buildDefaultCluster(t)
-	if errs := validation.ValidateCluster(c, false); len(errs) != 0 {
+	if errs := validation.ValidateCluster(c, false, vfs.Context); len(errs) != 0 {
 		klog.Infof("Cluster: %v", c)
 		t.Fatalf("Validate gave unexpected error (strict=false): %v", errs.ToAggregate())
 	}
-	if errs := validation.ValidateCluster(c, true); len(errs) != 0 {
+	if errs := validation.ValidateCluster(c, true, vfs.Context); len(errs) != 0 {
 		t.Fatalf("Validate gave unexpected error (strict=true): %v", errs.ToAggregate())
 	}
 }
@@ -199,7 +200,7 @@ func TestValidate_ContainerRegistry_and_ContainerProxy_exclusivity(t *testing.T)
 }
 
 func expectErrorFromValidate(t *testing.T, c *api.Cluster, message string) {
-	errs := validation.ValidateCluster(c, false)
+	errs := validation.ValidateCluster(c, false, vfs.Context)
 	if len(errs) == 0 {
 		t.Fatalf("Expected error from Validate")
 	}
@@ -210,7 +211,7 @@ func expectErrorFromValidate(t *testing.T, c *api.Cluster, message string) {
 }
 
 func expectNoErrorFromValidate(t *testing.T, c *api.Cluster) {
-	errs := validation.ValidateCluster(c, false)
+	errs := validation.ValidateCluster(c, false, vfs.Context)
 	if len(errs) != 0 {
 		t.Fatalf("Unexpected error from Validate: %v", errs.ToAggregate())
 	}