kubernetes/kops · error

invalid STS url: host=%q, path=%q

Error message

invalid STS url: host=%q, path=%q

What it means

Verification guard in verifyTokenV2: the presigned STS URL did not pass isValidV2 (wrong host/path — must be the STS endpoint and GetCallerIdentity action), so the URL is not a legitimate STS identity request.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:241

	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	if decoded.SignedHeader.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %v", err)
	}
	signedHeaders := sets.New(strings.Split(reqURL.Query().Get("X-Amz-SignedHeaders"), ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if !a.stsRequestValidator.isValidV2(reqURL) {
		return nil, fmt.Errorf("invalid STS url: host=%q, path=%q", reqURL.Host, reqURL.Path)
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

type verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)

func (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {
	if callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {
		return nil, fmt.Errorf("incorrect account %s", callerIdentity.GetCallerIdentityResult[0].Account)
	}

	arn := callerIdentity.GetCallerIdentityResult[0].Arn

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use the regional STS endpoint hostname
2. Presign a GetCallerIdentity request
3. Update kOps if the endpoint format changed

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:241 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/fdb1ff8c5f298ce1. Report an issue: GitHub.