kubernetes/kops · warning

Cannot determine host

Error message

Cannot determine host

What it means

handleOIDCDiscovery serves the /.well-known/openid-configuration document for a universe, deriving the issuer URL from the request's Host header. If the Host header is empty (r.Host == ""), the server cannot construct an issuer URL and rejects the request with 400 'Cannot determine host'. Per HTTP/1.1 Host is mandatory, so this indicates a malformed/proxied request.

Source

Thrown at discovery/pkg/discovery/oidc.go:38

	"encoding/json"
	"fmt"
	"net/http"
	"strings"

	"k8s.io/klog/v2"
	api "k8s.io/kops/discovery/apis/discovery.kops.k8s.io/v1alpha1"
)

func (s *Server) handleOIDCDiscovery(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	log := klog.FromContext(ctx)

	universeID := r.PathValue("universe")

	host := r.Host
	if host == "" {
		log.Info("Cannot determine host for OIDC discovery")
		http.Error(w, "Cannot determine host", http.StatusBadRequest)
		return
	}

	endpoints, err := s.Store.ListDiscoveryEndpoints(r.Context(), universeID)
	if err != nil {
		http.Error(w, fmt.Sprintf("Error listing endpoints: %v", err), http.StatusInternalServerError)
		return
	}

	issuerURL := "https://" + host + "/" + universeID + "/"

	var oidcSpec *api.OIDCSpec
	for _, ep := range endpoints {
		if ep.Spec.OIDC != nil {
			oidcSpec = ep.Spec.OIDC
			break
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Configure your reverse proxy/ingress to preserve and forward the Host header (e.g. nginx: proxy_set_header Host $host).
2. Send requests with an explicit Host header, e.g. curl -H 'Host: myhost' or use HTTP/1.1.
3. Access the server directly by DNS name so Go's http client populates Host automatically.
4. Check for middleware or load balancer settings that rewrite/strip Host.

Example fix

// before (proxy strips host)
proxy_set_header Host "";
// after
proxy_set_header Host $host;

if req.Host == "" { return errors.New("request would lack Host header; configure proxy or set Host") }

When it happens

Trigger: An HTTP client sends a request without a Host header (HTTP/1.0 client, raw socket request, or a reverse proxy that strips/rewrites the Host header before forwarding to the discovery server).

Common situations: Misconfigured ingress/nginx proxy that drops the Host header instead of passing it through; hand-rolled curl/telnet requests missing 'Host:'; health checks using HTTP/1.0.

Related errors

• Error listing endpoints: %v
• no TLS connection
• downloading %q: %w
• building http request: %v
• error reading tag file %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/657cb6ccbbb57de7. Report an issue: GitHub.