kubernetes/kops · error

building http request: %v

Error message

building http request: %v

What it means

signV1Request wraps an error from http.NewRequest when constructing the POST request to the STS endpoint with the GetCallerIdentity form body. This fails only if the STS URL is malformed (unparseable) — the body reader is an in-memory bytes.Reader and cannot fail.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:189

	if err != nil {
		return "", fmt.Errorf("converting token to json: %w", err)
	}

	return AWSAuthenticationTokenPrefixV2 + base64.StdEncoding.EncodeToString(token), nil
}

func signV1Request(ctx context.Context, stsURL string, region string, credentials aws.Credentials, signingTime time.Time, kopsRequestBody []byte) (*http.Request, error) {
	kopsRequestHash := sha256.Sum256(kopsRequestBody)
	kopsRequestHashBase64 := base64.RawStdEncoding.EncodeToString(kopsRequestHash[:])

	// V1 requests use a well-known body (and host)
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	bodyHash := sha256.Sum256(body)

	signedRequest, err := http.NewRequest("POST", stsURL, bytes.NewReader(body))
	if err != nil {
		return nil, fmt.Errorf("building http request: %v", err)
	}
	signedRequest.Header.Add("Content-Type", "application/x-www-form-urlencoded; charset=utf-8")
	signedRequest.Header.Add("X-Kops-Request-Sha", kopsRequestHashBase64)

	signer := v4.NewSigner()

	service := "sts"

	if err := signer.SignHTTP(ctx, credentials, signedRequest, hex.EncodeToString(bodyHash[:]), service, region, signingTime); err != nil {
		return nil, fmt.Errorf("error from SignHTTP: %v", err)
	}

	return signedRequest, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Log/inspect the stsURL passed to signV1Request and validate it parses (url.Parse) and has scheme https.
2. Fix any AWS_ENDPOINT_URL or BaseEndpoint override producing the bad URL.
3. In tests, pass a canonical URL like https://sts.us-east-1.amazonaws.com/.
4. If getSTSHost produced the host, verify the presigned URL parsing upstream (see the 'parsing AWS STS url' error).

Example fix

// before
err := signV1Request(ctx, host, region, creds, time.Now(), body) // host without scheme
// after
err := signV1Request(ctx, "https://"+host+"/", region, creds, time.Now(), body)

if _, err := url.Parse(stsURL); err != nil || !strings.HasPrefix(stsURL, "https://") {
	return fmt.Errorf("STS url must be a valid https URL, got %q", stsURL)
}

req, err := signV1Request(ctx, stsURL, region, creds, time.Now(), body)
if err != nil {
	return fmt.Errorf("check STS endpoint URL: %w", err)
}

When it happens

Trigger: http.NewRequest("POST", stsURL, bytes.NewReader(body)) errors inside signV1Request, reached via createTokenV1 from CreateToken or the TestAWSV1Request test: stsURL from getSTSHost is not a valid absolute URL.

Common situations: A corrupted STS host (e.g. empty or containing invalid characters) from a bad endpoint override; test harness passing a malformed stsURL directly to signV1Request; proxy/endpoint env tampering.

Related errors

• building (v1) signed request: %w
• parsing AWS STS url: %w
• error from SignHTTP: %v
• parsing STS request URL: %w
• parsing presigned url: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cdd6bc8ca29a5cae. Report an issue: GitHub.