kubernetes/kops · error

build STS request: %w

Error message

build STS request: %w

What it means

Wraps a failure of http.NewRequest in getCallerIdentityV1 while constructing the replayed STS GetCallerIdentity POST from the token headers. This is an internal construction failure of the verification request, not an API error.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:447

	if err != nil {
		return nil, fmt.Errorf("decoding STS response: %v", err)
	}

	return callerIdentity, nil
}

// GetCallerIdentityV1 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV1(ctx context.Context, httpClient *http.Client, decoded awsV1Token) (*GetCallerIdentityResponse, error) {
	// Well-known V1 request body
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	// The host is not passed in V1 (a shortcoming of V1)
	host := s.Host
	stsURL := "https://" + host + "/"

	req, err := http.NewRequest("POST", stsURL, bytes.NewReader(body))
	if err != nil {
		return nil, fmt.Errorf("build STS request: %w", err)
	}
	req.Header = http.Header(decoded)

	response, err := httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		return nil, fmt.Errorf("reading STS response: %v", err)
	}
	if response.StatusCode != 200 {
		return nil, fmt.Errorf("received status code %d from STS: %s", response.StatusCode, string(responseBody))
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the V1 token with valid headers
2. Check for malformed header values in the token
3. Report persistent failures to kOps maintainers

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:447 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6a7be9b9ca62b10e. Report an issue: GitHub.