{"record":{"id":"2a7eca9dc685e447","repo":"kubernetes/kops","slug":"sending-sts-request-v","errorCode":null,"errorMessage":"sending STS request: %v","messagePattern":"sending STS request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":413,"sourceCode":"// getCallerIdentityV2 will request the presigned token URL, and decode the returned identity.\nfunc (s *stsRequestValidator) getCallerIdentityV2(ctx context.Context, httpClient *http.Client, decoded *awsV2Token) (*GetCallerIdentityResponse, error) {\n\treqURL, err := url.Parse(decoded.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing STS request URL: %w\", err)\n\t}\n\n\tif !s.isValidV2(reqURL) {\n\t\treturn nil, fmt.Errorf(\"url not valid for STS request\")\n\t}\n\n\treq := &http.Request{\n\t\tURL:    reqURL,\n\t\tMethod: decoded.Method,\n\t\tHeader: decoded.SignedHeader,\n\t}\n\tresponse, err := httpClient.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"sending STS request: %v\", err)\n\t}\n\tif response != nil {\n\t\tdefer response.Body.Close()\n\t}\n\n\tresponseBody, err := io.ReadAll(response.Body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading STS response: %v\", err)\n\t}\n\tif response.StatusCode != 200 {\n\t\treturn nil, fmt.Errorf(\"received status code %d from STS: %s\", response.StatusCode, string(responseBody))\n\t}\n\n\tcallerIdentity := &GetCallerIdentityResponse{}\n\terr = xml.NewDecoder(bytes.NewReader(responseBody)).Decode(callerIdentity)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding STS response: %v\", err)\n\t}","sourceCodeStart":395,"sourceCodeEnd":431,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L395-L431","documentation":"Wraps a failure of httpClient.Do in getCallerIdentityV2: the verifier could not complete the HTTP request that replays the presigned STS URL (network error, DNS, TLS), so the caller identity cannot be fetched.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:413 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify network access to sts.amazonaws.com from nodes","Check DNS and TLS configuration","Retry the bootstrap request"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}