{"record":{"id":"a075792a90abc30e","repo":"kubernetes/kops","slug":"failed-to-resolve-endpoint-for-q-w","errorCode":null,"errorMessage":"failed to resolve endpoint for %q: %w","messagePattern":"failed to resolve endpoint for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3fs.go","lineNumber":588,"sourceCode":"\treturn &hashing.Hash{Algorithm: hashing.HashAlgorithmMD5, HashValue: md5Bytes}, nil\n}\n\nfunc (p *S3Path) GetHTTPsUrl(dualstack bool) (string, error) {\n\tctx := context.TODO()\n\n\tbucketDetails, err := p.getBucketDetails(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get bucket details for %q: %w\", p.String(), err)\n\t}\n\n\tresolver := s3.NewDefaultEndpointResolverV2()\n\tendpoint, err := resolver.ResolveEndpoint(ctx, s3.EndpointParameters{\n\t\tBucket:       aws.String(bucketDetails.name),\n\t\tRegion:       aws.String(bucketDetails.region),\n\t\tUseDualStack: aws.Bool(dualstack),\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to resolve endpoint for %q: %w\", p.String(), err)\n\t}\n\n\tendpoint.URI.Path = path.Join(endpoint.URI.Path, p.Key())\n\treturn endpoint.URI.String(), nil\n}\n\nfunc (p *S3Path) IsBucketPublic(ctx context.Context) (bool, error) {\n\tclient, err := p.client(ctx)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tresult, err := client.GetBucketPolicyStatus(ctx, &s3.GetBucketPolicyStatusInput{\n\t\tBucket: aws.String(p.bucket),\n\t})\n\tif err != nil && AWSErrorCode(err) != \"NoSuchBucketPolicy\" {\n\t\treturn false, fmt.Errorf(\"from AWS S3 GetBucketPolicyStatusWithContext: %w\", err)\n\t}","sourceCodeStart":570,"sourceCodeEnd":606,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3fs.go#L570-L606","documentation":"In GetHTTPsUrl, after bucket details are fetched, kOps uses the AWS SDK v2 endpoint resolver (s3.NewDefaultEndpointResolverV2) to compute the bucket's HTTPS endpoint. This error wraps a ResolveEndpoint failure — typically an invalid or unsupported region string in the bucket's metadata. The URL is never produced.","triggerScenarios":"Calling GetHTTPsUrl when resolver.ResolveEndpoint fails because the bucket's region is empty or unrecognized (e.g. legacy region strings, typo'd region in config, or an unsupported partition like a gov/s3-outposts edge case).","commonSituations":"State buckets in unusual partitions (us-gov, cn) with an SDK built without those endpoints; AWS_REGION env var set to a bogus value so bucket details inherit it; stale SDK versions predating a new region.","solutions":["Check the wrapped resolver error for the offending region and correct AWS_REGION / cluster region configuration.","Upgrade the aws-sdk-go-v2 module (and kops) to pick up current endpoint resolution data for newer regions/partitions.","For non-standard partitions, set a custom endpoint/base region supported by the SDK.","Verify the bucket actually reports a valid region via aws s3api get-bucket-location --bucket <name>."],"exampleFix":"// before\nexport AWS_REGION=us-east-11  // typo\n// after\nexport AWS_REGION=us-east-1","handlingStrategy":"validation","validationCode":"region := os.Getenv(\"AWS_REGION\")\nif !regexp.MustCompile(`^(us|eu|ap|ca|sa|me|af|il)-(gov|cn)?-?[a-z]+-\\d$`).MatchString(region) { // invalid region — fix before resolving endpoints }\nloc, err := client.GetBucketLocation(ctx, &s3.GetBucketLocationInput{Bucket: aws.String(bucket)}) // confirm real region","typeGuard":"func isValidAWSRegion(s string) bool {\n    re := regexp.MustCompile(`^[a-z]{2}(-gov)?(-[a-z]+)?-[a-z]+-\\d$`)\n    return re.MatchString(s)\n}","tryCatchPattern":"url, err := s3Path.GetHTTPsUrl(false)\nif err != nil && strings.Contains(err.Error(), \"endpoint\") {\n    return fmt.Errorf(\"check AWS_REGION/bucket region (%q) and SDK version: %w\", region, err)\n}","preventionTips":["Set AWS_REGION to a valid, current region code — verify with aws configure get region.","Keep aws-sdk-go-v2 up to date for new region/partition endpoint data.","Use the bucket's actual reported region (GetBucketLocation), not assumptions.","For gov-cloud/CN partitions, ensure the SDK and configuration target that partition explicitly."],"tags":["aws","s3","endpoint","region","configuration"],"backgroundTag":"s3-endpoint-resolution-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}