kubernetes/kops · error

failed to resolve endpoint for %q: %w

Error message

failed to resolve endpoint for %q: %w

What it means

In GetHTTPsUrl, after bucket details are fetched, kOps uses the AWS SDK v2 endpoint resolver (s3.NewDefaultEndpointResolverV2) to compute the bucket's HTTPS endpoint. This error wraps a ResolveEndpoint failure — typically an invalid or unsupported region string in the bucket's metadata. The URL is never produced.

Source

Thrown at util/pkg/vfs/s3fs.go:588

	return &hashing.Hash{Algorithm: hashing.HashAlgorithmMD5, HashValue: md5Bytes}, nil
}

func (p *S3Path) GetHTTPsUrl(dualstack bool) (string, error) {
	ctx := context.TODO()

	bucketDetails, err := p.getBucketDetails(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to get bucket details for %q: %w", p.String(), err)
	}

	resolver := s3.NewDefaultEndpointResolverV2()
	endpoint, err := resolver.ResolveEndpoint(ctx, s3.EndpointParameters{
		Bucket:       aws.String(bucketDetails.name),
		Region:       aws.String(bucketDetails.region),
		UseDualStack: aws.Bool(dualstack),
	})
	if err != nil {
		return "", fmt.Errorf("failed to resolve endpoint for %q: %w", p.String(), err)
	}

	endpoint.URI.Path = path.Join(endpoint.URI.Path, p.Key())
	return endpoint.URI.String(), nil
}

func (p *S3Path) IsBucketPublic(ctx context.Context) (bool, error) {
	client, err := p.client(ctx)
	if err != nil {
		return false, err
	}

	result, err := client.GetBucketPolicyStatus(ctx, &s3.GetBucketPolicyStatusInput{
		Bucket: aws.String(p.bucket),
	})
	if err != nil && AWSErrorCode(err) != "NoSuchBucketPolicy" {
		return false, fmt.Errorf("from AWS S3 GetBucketPolicyStatusWithContext: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped resolver error for the offending region and correct AWS_REGION / cluster region configuration.
2. Upgrade the aws-sdk-go-v2 module (and kops) to pick up current endpoint resolution data for newer regions/partitions.
3. For non-standard partitions, set a custom endpoint/base region supported by the SDK.
4. Verify the bucket actually reports a valid region via aws s3api get-bucket-location --bucket <name>.

Example fix

// before
export AWS_REGION=us-east-11  // typo
// after
export AWS_REGION=us-east-1

region := os.Getenv("AWS_REGION")
if !regexp.MustCompile(`^(us|eu|ap|ca|sa|me|af|il)-(gov|cn)?-?[a-z]+-\d$`).MatchString(region) { // invalid region — fix before resolving endpoints }
loc, err := client.GetBucketLocation(ctx, &s3.GetBucketLocationInput{Bucket: aws.String(bucket)}) // confirm real region

func isValidAWSRegion(s string) bool {
    re := regexp.MustCompile(`^[a-z]{2}(-gov)?(-[a-z]+)?-[a-z]+-\d$`)
    return re.MatchString(s)
}

url, err := s3Path.GetHTTPsUrl(false)
if err != nil && strings.Contains(err.Error(), "endpoint") {
    return fmt.Errorf("check AWS_REGION/bucket region (%q) and SDK version: %w", region, err)
}

When it happens

Trigger: Calling GetHTTPsUrl when resolver.ResolveEndpoint fails because the bucket's region is empty or unrecognized (e.g. legacy region strings, typo'd region in config, or an unsupported partition like a gov/s3-outposts edge case).

Common situations: State buckets in unusual partitions (us-gov, cn) with an SDK built without those endpoints; AWS_REGION env var set to a bogus value so bucket details inherit it; stale SDK versions predating a new region.

Related errors

• resolving EC2 endpoint for region %q: %w
• DeviceName not set for volume
• error populating configuration: %v
• error initializing AWS client: %v
• error populating configuration: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a075792a90abc30e. Report an issue: GitHub.