Conversation
anxkhn
force-pushed
the
loop/kanister__001
branch
from
July 1, 2026 07:40
445ab56 to
8770581
Compare
anxkhn
force-pushed
the
loop/kanister__001
branch
from
August 12, 2026 05:24
8770581 to
267cca8
Compare
When a profile sets an explicit endpoint of s3.amazonaws.com together with a non us-east-1 region (e.g. eu-west-1), bucket region validation failed with: GetBucketLocation: AuthorizationHeaderMalformed: ... the region 'eu-west-1' is wrong; expecting 'us-east-1' s3.amazonaws.com is the legacy global (us-east-1) endpoint, so requests to it must be signed for us-east-1; the SDK was signing GetBucketLocation with the user-supplied region instead. This broke `kanctl create profile` and `kando` whenever an AWS endpoint was provided for a bucket outside us-east-1. Override the signing region to us-east-1 for the single GetBucketLocation call only when the configured endpoint is the AWS global endpoint. Region-specific AWS endpoints (s3.<region>.amazonaws.com) and s3-compatible stores (MinIO/Ceph) keep the configured region, so TestInvalidS3RegionEndpointMismatch and existing behaviour are unaffected. Add a credential-free unit test for the global-endpoint detection; the existing objectstore suite still requires live AWS/MinIO and is exercised in CI. Ref kanisterio#3613 Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
anxkhn
force-pushed
the
loop/kanister__001
branch
from
August 13, 2026 07:43
267cca8 to
4028de6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Overview
When a profile sets an explicit endpoint of
s3.amazonaws.comtogether with anon
us-east-1region (e.g.eu-west-1), bucket region validation fails:s3.amazonaws.comis the legacy global (us-east-1) S3 endpoint, so requests toit must be signed for
us-east-1. The SDK was signingGetBucketLocationwiththe user-supplied region, which S3 rejects. This broke
kanctl create profileand
kandowhenever an AWS endpoint was provided for a bucket outsideus-east-1; the documented workaround is to drop
--endpoint.This overrides the signing region to
us-east-1for that singleGetBucketLocationcall, gated to the AWS global endpoint only. Region-specificAWS endpoints (
s3.<region>.amazonaws.com) and s3-compatible stores(MinIO/Ceph) keep the configured region, so
TestInvalidS3RegionEndpointMismatchand existing behaviour are unaffected.
Pull request type
Please check the type of change your PR introduces:
Issues
Test Plan
TestIsAWSGlobalS3Endpointcovering scheme-less / scheme / trailing-slash global endpoints, region-specific
AWS endpoints, MinIO/Ceph, and empty input.
CI (it requires AWS creds / MinIO and is skipped without them).