{"record":{"id":"6a7be9b9ca62b10e","repo":"kubernetes/kops","slug":"build-sts-request-w","errorCode":null,"errorMessage":"build STS request: %w","messagePattern":"build STS request: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":447,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding STS response: %v\", err)\n\t}\n\n\treturn callerIdentity, nil\n}\n\n// GetCallerIdentityV1 will request the presigned token URL, and decode the returned identity.\nfunc (s *stsRequestValidator) getCallerIdentityV1(ctx context.Context, httpClient *http.Client, decoded awsV1Token) (*GetCallerIdentityResponse, error) {\n\t// Well-known V1 request body\n\tbody := []byte(\"Action=GetCallerIdentity&Version=2011-06-15\")\n\n\t// The host is not passed in V1 (a shortcoming of V1)\n\thost := s.Host\n\tstsURL := \"https://\" + host + \"/\"\n\n\treq, err := http.NewRequest(\"POST\", stsURL, bytes.NewReader(body))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"build STS request: %w\", err)\n\t}\n\treq.Header = http.Header(decoded)\n\n\tresponse, err := httpClient.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"sending STS request: %v\", err)\n\t}\n\tif response != nil {\n\t\tdefer response.Body.Close()\n\t}\n\n\tresponseBody, err := io.ReadAll(response.Body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading STS response: %v\", err)\n\t}\n\tif response.StatusCode != 200 {\n\t\treturn nil, fmt.Errorf(\"received status code %d from STS: %s\", response.StatusCode, string(responseBody))\n\t}","sourceCodeStart":429,"sourceCodeEnd":465,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L429-L465","documentation":"Wraps a failure of http.NewRequest in getCallerIdentityV1 while constructing the replayed STS GetCallerIdentity POST from the token headers. This is an internal construction failure of the verification request, not an API error.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:447 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the V1 token with valid headers","Check for malformed header values in the token","Report persistent failures to kOps maintainers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}