kubernetes/kops · error

parsing STS request URL: %w

Error message

parsing STS request URL: %w

What it means

The V2 bootstrap token carries a presigned AWS STS GetCallerIdentity URL supplied by the node. The verifier parses that untrusted URL with url.Parse before validating and sending it; if the URL string is malformed and cannot be parsed, the request is rejected with this wrapped error.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:399

	}
	if u.Path != "/" {
		return false
	}
	if u.Query().Get("Action") != "GetCallerIdentity" {
		return false
	}
	if len(u.Query()["Action"]) != 1 {
		return false
	}

	return true
}

// getCallerIdentityV2 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV2(ctx context.Context, httpClient *http.Client, decoded *awsV2Token) (*GetCallerIdentityResponse, error) {
	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %w", err)
	}

	if !s.isValidV2(reqURL) {
		return nil, fmt.Errorf("url not valid for STS request")
	}

	req := &http.Request{
		URL:    reqURL,
		Method: decoded.Method,
		Header: decoded.SignedHeader,
	}
	response, err := httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the bootstrap token on the node (re-run nodeup / kops bootstrap flow) so a freshly, correctly presigned STS URL is sent.
2. Confirm nodeup and kOps use compatible AWS SDK versions to produce/consume the presigned URL format.
3. Check that the token isn't being truncated or mangled in storage/transport (ConfigMap size limits, shell quoting).
4. Log the failing URL (server-side) to confirm whether it is empty, truncated, or contains invalid characters.

if _, err := url.Parse(token.URL); err != nil {
  return fmt.Errorf("refusing to send bootstrap token: presigned STS URL is not parseable: %w", err)
}

func hasParsableSTSURL(t awsV2Token) bool {
  u, err := url.Parse(t.URL)
  return err == nil && u.Scheme != "" && u.Host != ""
}

result, err := verifier.VerifyToken(ctx, token)
if err != nil && strings.Contains(err.Error(), "parsing STS request URL") {
  // token is corrupt/truncated: regenerate it on the node and retry once
  token = regenerateBootstrapToken()
  return verifier.VerifyToken(ctx, token)
}

When it happens

Trigger: verifyTokenV2 decodes an awsV2Token whose URL field fails url.Parse — e.g. the token was truncated, corrupted in transport, or a client constructed the presigned URL incorrectly.

Common situations: Token truncated when passed through ConfigMap/secret or CLI flag; node running an AWS SDK version producing a differently-formatted presigned URL than expected; manual tampering or a proxy mangling the token; clock/credential issues causing clients to hand-build URLs.

Related errors

• parsing presigned url: %w
• getting AWS STS url: %w
• building AWS STS presigned request: %w
• parsing AWS STS url: %w
• arn %q has unrecognized type

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9473bf2fe611e52c. Report an issue: GitHub.