kubernetes/kops · error

parsing base URL: %w

Error message

parsing base URL: %w

What it means

microsoftIntermediateCandidateURLs could not url.Parse the configured base URL for intermediate fetching — a malformed configuration value, since the base URL is operator-supplied, not from the certificate.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:495

	}
	if len(signer.AuthorityKeyId) > 0 && !bytes.Equal(cert.SubjectKeyId, signer.AuthorityKeyId) {
		return fmt.Errorf("fetched certificate subject key identifier does not match signer authority key identifier")
	}

	return nil
}

// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only
// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them
// onto the configured scheme and host.
func microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")
	}

	base, err := url.Parse(baseURL)
	if err != nil {
		return nil, fmt.Errorf("parsing base URL: %w", err)
	}
	if !base.IsAbs() || base.Host == "" {
		return nil, fmt.Errorf("base URL must be absolute")
	}

	basePath := path.Clean(strings.TrimRight(base.Path, "/"))
	if basePath == "." || basePath == "/" {
		return nil, fmt.Errorf("base URL path is too broad")
	}

	var urls []string
	seen := make(map[string]struct{})
	for _, rawURL := range signer.IssuingCertificateURL {
		normalized, ok := normalizeMicrosoftIntermediateURL(base, basePath, rawURL)
		if !ok {
			continue
		}
		if _, found := seen[normalized]; found {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the Microsoft intermediate cert base URL configuration to a valid absolute URL

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:495 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/99ef1434768165e8. Report an issue: GitHub.