kubernetes/kops · error

base URL path is too broad

Error message

base URL path is too broad

What it means

Allowlist guard on the intermediate-fetch base URL: its path is broader than the permitted Microsoft PKI path prefix, which would let AIA-supplied URLs escape the intended path scope. The base URL configuration is at fault.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:503

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them
// onto the configured scheme and host.
func microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")
	}

	base, err := url.Parse(baseURL)
	if err != nil {
		return nil, fmt.Errorf("parsing base URL: %w", err)
	}
	if !base.IsAbs() || base.Host == "" {
		return nil, fmt.Errorf("base URL must be absolute")
	}

	basePath := path.Clean(strings.TrimRight(base.Path, "/"))
	if basePath == "." || basePath == "/" {
		return nil, fmt.Errorf("base URL path is too broad")
	}

	var urls []string
	seen := make(map[string]struct{})
	for _, rawURL := range signer.IssuingCertificateURL {
		normalized, ok := normalizeMicrosoftIntermediateURL(base, basePath, rawURL)
		if !ok {
			continue
		}
		if _, found := seen[normalized]; found {
			continue
		}
		seen[normalized] = struct{}{}
		urls = append(urls, normalized)
	}

	if len(urls) == 0 {
		return nil, fmt.Errorf("no valid Microsoft PKI AIA URLs found")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Narrow the configured base URL path to the approved Microsoft PKI certificate path

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:503 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d4e67b18744abdf2. Report an issue: GitHub.