kubernetes/kops · error

decoding STS response: %v

Error message

decoding STS response: %v

What it means

getCallerIdentityV2 wraps the XML decode failure of the STS GetCallerIdentity response. STS replies in XML; an undecodable body means a non-STS response was received (proxy error page, truncated body), and the node's caller identity cannot be verified.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:430

	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		return nil, fmt.Errorf("reading STS response: %v", err)
	}
	if response.StatusCode != 200 {
		return nil, fmt.Errorf("received status code %d from STS: %s", response.StatusCode, string(responseBody))
	}

	callerIdentity := &GetCallerIdentityResponse{}
	err = xml.NewDecoder(bytes.NewReader(responseBody)).Decode(callerIdentity)
	if err != nil {
		return nil, fmt.Errorf("decoding STS response: %v", err)
	}

	return callerIdentity, nil
}

// GetCallerIdentityV1 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV1(ctx context.Context, httpClient *http.Client, decoded awsV1Token) (*GetCallerIdentityResponse, error) {
	// Well-known V1 request body
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	// The host is not passed in V1 (a shortcoming of V1)
	host := s.Host
	stsURL := "https://" + host + "/"

	req, err := http.NewRequest("POST", stsURL, bytes.NewReader(body))
	if err != nil {
		return nil, fmt.Errorf("build STS request: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check for proxies rewriting STS responses
2. Retry the request
3. Verify the STS endpoint is genuine

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:430 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1a8d6e46e783bc18. Report an issue: GitHub.