{"record":{"id":"5925374325750d46","repo":"kubernetes/kops","slug":"getting-aws-credentials-w","errorCode":null,"errorMessage":"getting AWS credentials: %w","messagePattern":"getting AWS credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":115,"sourceCode":"\t// The issue is that if we upgrade the nodes before the control plane,\n\t// the nodes are using v2 authentication against a v1 verifier.\n\t// By having the server support v1 and v2, but the nodes continue to use\n\t// v1 for now, we can introduce v2 support and then enable it in a few versions.\n\t// The \"nodes before control plane\" is not the common case,\n\t// and nodes at much higher versions is not guaranteed to be supported by kube,\n\t// so once we are at kOps 1.32 this shoud be safe to flip to use V2.\n\t// It's possibly safe at kOps 1.31 but that might need more careful analysis.\n\tsignWithV1 := true\n\tif signWithV1 {\n\t\treturn a.createTokenV1(ctx, body)\n\t}\n\treturn a.createTokenV2(ctx, body)\n}\n\nfunc (a *awsAuthenticator) createTokenV1(ctx context.Context, body []byte) (string, error) {\n\tcredentials, err := a.credentialsProvider.Retrieve(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS credentials: %w\", err)\n\t}\n\n\thost, err := a.getSTSHost(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS STS url: %w\", err)\n\t}\n\tstsURL := \"https://\" + host + \"/\"\n\tregion := a.region\n\n\treq, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building (v1) signed request: %w\", err)\n\t}\n\theaders, err := json.Marshal(req.Header)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"converting headers to json: %w\", err)\n\t}\n\treturn AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L97-L133","documentation":"createTokenV1 wraps any failure from the AWS SDK credentials provider when retrieving credentials for SigV4 signing of the kOps bootstrap GetCallerIdentity request. The credentials chain (env vars, shared config, IMDS, IRSA/EKS pod identity, container credentials) returned an error, so a signed token cannot be minted. This is thrown by kOps' AWS authenticator in pkg/bootstrap/awsbootstrap.","triggerScenarios":"a.credentialsProvider.Retrieve(ctx) returns an error during CreateToken (v1 path): no AWS credentials resolvable in the process environment, expired/stale credentials, IMDS unreachable/timing out, or an invalid credentials config passed to awsAuthenticator creation.","commonSituations":"Running `kops get addons`/bootstrap commands outside a cluster node without AWS_ACCESS_KEY_ID/SECRET set; ~/.aws/credentials missing or malformed; on EKS without an IRSA service-account token or pod identity agent; EC2 IMDSv2 hop limit blocking metadata from a container; expired session tokens with AWS_SESSION_TOKEN stale.","solutions":["Verify credentials resolve in the same environment: run `aws sts get-caller-identity` with the same env/profile/user.","Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and (if needed) AWS_SESSION_TOKEN, or configure the correct AWS_PROFILE / AWS_SHARED_CREDENTIALS_FILE.","On EKS, attach an IRSA service account annotation (eks.amazonaws.com/role-arn) or use EKS Pod Identity, and confirm the trust policy allows the pod.","If relying on IMDS, check the instance has an IAM role attached and that IMDSv2 hop limit >= 2 for containers.","Check region configuration (AWS_REGION/AWS_DEFAULT_REGION) and that STS is reachable from the network."],"exampleFix":"// before: authenticator built with no creds source\nauth, err := awsbootstrap.NewAuthenticator(ctx, region, nil, nil)\n// after: pass an explicit, resolvable provider\ncreds := aws.NewCredentialsCache(aws.NewStaticCredentialsProvider(key, secret, token))\nauth, err := awsbootstrap.NewAuthenticator(ctx, region, stsClient, creds)","handlingStrategy":"validation","validationCode":"creds, err := credProvider.Retrieve(ctx)\nif err != nil || creds.AccessKeyID == \"\" {\n\treturn fmt.Errorf(\"AWS credentials unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"token, err := auth.CreateToken(body)\nif err != nil {\n\tvar credErr *aws.CredentialsCacheError\n\tif errors.As(err, &credErr) { /* re-authenticate / refresh creds */ }\n}","preventionTips":["Run `aws sts get-caller-identity` in the same shell/user before bootstrap commands.","On EKS use IRSA or Pod Identity rather than static keys.","Set AWS_PROFILE explicitly instead of relying on defaults."],"tags":["aws","credentials","authentication","bootstrap"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}