{"record":{"id":"124e113746692538","repo":"JuliusBrussee/caveman","slug":"kms-s-request-failed-w","errorCode":null,"errorMessage":"kms: %s request failed: %w","messagePattern":"kms: (.+?) request failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":362,"sourceCode":"}\n\nfunc (c *Client) call(ctx context.Context, region, keyID, operation string, input, output any) error {\n\tbody, err := json.Marshal(input)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: encode %s request: %w\", operation, err)\n\t}\n\tendpoint := c.apiBaseURL + \"/key-manager/v1alpha1/regions/\" + url.PathEscape(region) +\n\t\t\"/keys/\" + url.PathEscape(keyID) + \"/\" + operation\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: create %s request: %w\", operation, err)\n\t}\n\treq.Header.Set(\"content-type\", \"application/json\")\n\treq.Header.Set(\"accept\", \"application/json\")\n\treq.Header.Set(\"x-auth-token\", c.token)\n\tresp, err := c.httpClient.Do(req)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: %s request failed: %w\", operation, err)\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != http.StatusOK {\n\t\t_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 32<<10))\n\t\treturn fmt.Errorf(\"kms: %s returned HTTP %d\", operation, resp.StatusCode)\n\t}\n\tdata, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes+1))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: read %s response: %w\", operation, err)\n\t}\n\tif len(data) > maxResponseBytes {\n\t\treturn fmt.Errorf(\"kms: %s response exceeds limit\", operation)\n\t}\n\tif err := json.Unmarshal(data, output); err != nil {\n\t\treturn fmt.Errorf(\"kms: decode %s response: %w\", operation, err)\n\t}\n\treturn nil\n}","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/kms/kms.go#L344-L380","documentation":"Inside the low-level call helper: the POST to {apiBaseURL}/key-manager/v1alpha1/regions/{region}/keys/{keyID}/{operation} failed at the transport level (httpClient.Do returned an error). The %w wraps Go net/http errors — DNS failure, connection refused, TLS handshake problems, timeouts, or context cancellation. This is distinct from 1198, which fires when the request completes but the status is not 200.","triggerScenarios":"DNS for the Scaleway API not resolvable from the container; connection refused by an egress firewall; TLS certificate validation failing behind a MITM proxy; context cancelled/deadline exceeded because the caller's ctx timed out; proxy misconfiguration in HTTP_PROXY env vars.","commonSituations":"Kubernetes cluster without egress rules allowing the KMS endpoint; corporate MITM proxy whose CA is not in the trust store; short client-side context deadlines; local dev on VPN with split DNS not resolving internal/API names.","solutions":["Read the wrapped net/http error — 'connection refused'/'no such host' point at network, 'context deadline exceeded' at your timeout","Verify egress to the key-manager API endpoint is allowed (firewall, NetworkPolicy, proxy)","If behind a TLS-inspecting proxy, add its CA to the client's trust store or configure the http.Client accordingly","Increase or remove an overly tight context deadline on the KMS call path"],"exampleFix":"// before\nctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)\ndeferred := cancel\n_ = client.Encrypt(ctx, plaintext)\n\n// after\nctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)\ndefer cancel()\n_ = client.Encrypt(ctx, plaintext)","handlingStrategy":"retry","validationCode":"func canReachKMS(ctx context.Context, endpoint string) bool {\n\treq, _ := http.NewRequestWithContext(ctx, http.MethodHead, endpoint, nil)\n\tresp, err := http.DefaultClient.Do(req)\n\tif err != nil { return false }\n\tresp.Body.Close()\n\treturn true\n}","typeGuard":null,"tryCatchPattern":"var pt []byte\nerr := backoffRetry(func() error {\n\tvar e error\n\tpt, e = client.Encrypt(ctx, plaintext)\n\treturn e\n}) // retry only on transport errors (kms: ... request failed)","preventionTips":["Give KMS calls their own context with a sane (multi-second) deadline","Pre-flight DNS/egress checks for the KMS endpoint in deployment smoke tests","Trust the system CA store or explicitly configure proxies for MITM environments"],"tags":["go","kms","network","http"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}