kubernetes/kops · error

escaping nodeup source %q: %w

Error message

escaping nodeup source %q: %w

What it means

nodeUpSource wraps any failure from the per-scheme escape function (escapeS3Location or escapeBlobLocation) when preparing the nodeup download source URLs. It indicates that one of the configured NodeUpSource locations could not be parsed or escaped into a safe form for embedding in the nodeup bootstrap script. The wrapped inner error carries the specific cause.

Source

Thrown at pkg/model/resources/nodeup.go:276

	asset := b.NodeUpAssets[arch]
	if asset == nil {
		return "", nil
	}

	locations := slices.Clone(asset.Locations)
	for i, location := range locations {
		var escape func(string) (string, error)
		switch {
		case strings.HasPrefix(location, "s3://"):
			escape = escapeS3Location
		case strings.HasPrefix(location, "azureblob://"):
			escape = escapeBlobLocation
		default:
			continue
		}
		escaped, err := escape(location)
		if err != nil {
			return "", fmt.Errorf("escaping nodeup source %q: %w", location, err)
		}
		locations[i] = escaped
	}
	return strings.Join(locations, ","), nil
}

func escapeS3Location(location string) (string, error) {
	u, err := url.Parse(location)
	if err != nil {
		return "", fmt.Errorf("parsing S3 location: %w", err)
	}
	if u.Scheme != "s3" || u.Host == "" {
		return "", fmt.Errorf("invalid S3 location")
	}

	return "s3://" + u.Host + httpbinding.EscapePath(u.Path, false), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped inner error for the actual parse/validation failure.
2. Print and fix the NodeUpSource location value in the cluster spec so it is a well-formed s3://bucket/key or azureblob://account/container/key URL.
3. If constructing locations programmatically, validate with url.Parse before passing them in.
4. Re-run kops update/apply after correcting the source.

Example fix

// before
NodeUpSource: "s3://my bucket/kops/linux/amd64/nodeup"
// after
NodeUpSource: "s3://my-bucket/kops/linux/amd64/nodeup"

for _, loc := range strings.Split(nodeUpSource, ",") {
    if _, err := url.Parse(strings.TrimSpace(loc)); err != nil {
        return fmt.Errorf("invalid nodeup source %q: %w", loc, err)
    }
}

func isValidURL(loc string) bool { _, err := url.Parse(loc); return err == nil }

src, err := b.nodeUpSource(arch)
if err != nil {
    return fmt.Errorf("nodeup source invalid, check s3://azureblob:// URLs: %w", err)
}

When it happens

Trigger: Calling Build (directly or via GetBootstrapData/renderNodeUpScript/kubeEnv) while a NodeUpSource location for the target architecture uses the s3:// or azureblob:// scheme and that location either fails url.Parse or is rejected by the scheme's escape validator.

Common situations: Typos or malformed URLs in the cluster spec (e.g. 's3://bucket path/key' with spaces, missing bucket), wrong scheme casing, or an azureblob:// URL with query strings or credentials pasted from the portal.

Related errors

• building nodeConfig for instanceGroup: %w
• unsupported cloud provider for authenticator %q
• no keypairID for %q
• parsing STS request URL: %w
• parsing presigned url: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a18c83651cd22676. Report an issue: GitHub.