kubernetes/kops · error

getting AWS STS url: %w

Error message

getting AWS STS url: %w

What it means

createTokenV1 wraps a failure from getSTSHost, which resolves the regional STS endpoint hostname by building a presigned GetCallerIdentity request. If the presign call fails, the authenticator cannot determine the STS URL to sign against, so the v1 token creation aborts.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:120

	// and nodes at much higher versions is not guaranteed to be supported by kube,
	// so once we are at kOps 1.32 this shoud be safe to flip to use V2.
	// It's possibly safe at kOps 1.31 but that might need more careful analysis.
	signWithV1 := true
	if signWithV1 {
		return a.createTokenV1(ctx, body)
	}
	return a.createTokenV2(ctx, body)
}

func (a *awsAuthenticator) createTokenV1(ctx context.Context, body []byte) (string, error) {
	credentials, err := a.credentialsProvider.Retrieve(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS credentials: %w", err)
	}

	host, err := a.getSTSHost(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS STS url: %w", err)
	}
	stsURL := "https://" + host + "/"
	region := a.region

	req, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)
	if err != nil {
		return "", fmt.Errorf("building (v1) signed request: %w", err)
	}
	headers, err := json.Marshal(req.Header)
	if err != nil {
		return "", fmt.Errorf("converting headers to json: %w", err)
	}
	return AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil
}

func (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {
	// An inefficient but reliable way to get the STS url
	presignClient := sts.NewPresignClient(a.sts)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the STS client passed to the authenticator was built with a valid AWS region (AWS_REGION or config option WithRegion).
2. Run `aws sts get-caller-identity --region <region>` to confirm the regional STS endpoint resolves from this machine.
3. Check for a custom BaseEndpoint/endpoint override on the sts.Client that may be wrong or unreachable.
4. Regenerate the sts.Client from a fresh config.LoadDefaultConfig call with proper credential/region options.

Example fix

// before
cfg, _ := config.LoadDefaultConfig(ctx)
stsc := sts.NewFromConfig(cfg) // region may be empty
// after
cfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
stsc := sts.NewFromConfig(cfg)

if cfg.Region == "" {
	return fmt.Errorf("AWS region must be set (AWS_REGION or config.WithRegion)")
}

host, err := a.getSTSHost(ctx)
if err != nil {
	return fmt.Errorf("cannot resolve STS endpoint, check region config: %w", err)
}

When it happens

Trigger: a.getSTSHost(ctx) errors inside CreateToken (v1 path): sts.NewPresignClient(a.sts).PresignGetCallerIdentity fails due to nil/misconfigured STS client, invalid region, or SDK client construction failure.

Common situations: STS client built with an unknown/unsupported region name; AWS SDK config LoadDefaultConfig failed silently producing a client with no region; endpoint override pointing to an unreachable custom STS endpoint; SDK version mismatch in sts options.

Related errors

• building AWS STS presigned request: %w
• arn %q has unrecognized type
• arn %q contains too few slashes
• parsing STS request URL: %w
• parsing presigned url: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/789520b98f58d3a0. Report an issue: GitHub.