kubernetes/kops · error

failed to get bucket details for %q: %w

Error message

failed to get bucket details for %q: %w

What it means

S3Path.GetHTTPsUrl builds a direct HTTPS console/API URL for the S3 object. Before resolving an endpoint it must determine the bucket's name and region via getBucketDetails (a HeadBucket-style call); this error wraps any failure of that lookup — the endpoint resolver never runs. The wrapped cause (usually NoSuchBucket or AccessDenied) is embedded via %w.

Source

Thrown at util/pkg/vfs/s3fs.go:578

		return nil, nil
	}

	md5 := strings.Trim(*p.etag, "\"")

	md5Bytes, err := hex.DecodeString(md5)
	if err != nil {
		return nil, fmt.Errorf("Etag was not a valid MD5 sum: %q", *p.etag)
	}

	return &hashing.Hash{Algorithm: hashing.HashAlgorithmMD5, HashValue: md5Bytes}, nil
}

func (p *S3Path) GetHTTPsUrl(dualstack bool) (string, error) {
	ctx := context.TODO()

	bucketDetails, err := p.getBucketDetails(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to get bucket details for %q: %w", p.String(), err)
	}

	resolver := s3.NewDefaultEndpointResolverV2()
	endpoint, err := resolver.ResolveEndpoint(ctx, s3.EndpointParameters{
		Bucket:       aws.String(bucketDetails.name),
		Region:       aws.String(bucketDetails.region),
		UseDualStack: aws.Bool(dualstack),
	})
	if err != nil {
		return "", fmt.Errorf("failed to resolve endpoint for %q: %w", p.String(), err)
	}

	endpoint.URI.Path = path.Join(endpoint.URI.Path, p.Key())
	return endpoint.URI.String(), nil
}

func (p *S3Path) IsBucketPublic(ctx context.Context) (bool, error) {
	client, err := p.client(ctx)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error: for NoSuchBucket verify the bucket name in the state store path is correct and exists.
2. For AccessDenied, grant the caller s3:GetBucketLocation (and HeadBucket) on the bucket ARN.
3. Re-authenticate / refresh credentials (aws sts get-caller-identity) if the cause is an auth failure.
4. Retry if the wrapped error indicates a transient network problem.

Example fix

// before
url, err := s3Path.GetHTTPsUrl(false)
// after
url, err := s3Path.GetHTTPsUrl(false)
if err != nil && strings.Contains(err.Error(), "NotFound") {
    // validate bucket: aws s3api head-bucket --bucket <name> before retrying
}

// verify bucket exists and credentials work before GetHTTPsUrl
_, err := client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)})
if err != nil { return fmt.Errorf("bucket %s unreachable: %w", bucket, err) }
out, _ := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}) // credentials check

func isBucketMissing(err error) bool {
    return err != nil && strings.Contains(err.Error(), "NotFound")
}

url, err := s3Path.GetHTTPsUrl(false)
if err != nil {
    if strings.Contains(err.Error(), "NotFound") {
        return fmt.Errorf("state bucket %s not found — check --state: %w", bucket, err)
    }
    return err
}

When it happens

Trigger: Calling GetHTTPsUrl on an S3Path when getBucketDetails fails: bucket doesn't exist, the caller lacks s3:GetBucketLocation/HeadBucket permission, or the request can't reach the S3 API (network/credentials).

Common situations: Generating shareable URLs for state-store objects against a deleted or misspelled bucket; IAM role without HeadBucket rights; expired AWS credentials in kops controller environments.

Related errors

• checking if bucket was public: %w
• error listing %s: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• getting location for bucket %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3d143a0db4bcb5b7. Report an issue: GitHub.