kubernetes/kops · error

reading STS response: %v

Error message

reading STS response: %v

What it means

getCallerIdentityV2 wraps io.ReadAll failure on the STS HTTP response body. The request itself succeeded at transport level, but the body could not be read (connection reset mid-response, truncated stream), so caller identity cannot be extracted.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:421

		return nil, fmt.Errorf("url not valid for STS request")
	}

	req := &http.Request{
		URL:    reqURL,
		Method: decoded.Method,
		Header: decoded.SignedHeader,
	}
	response, err := httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		return nil, fmt.Errorf("reading STS response: %v", err)
	}
	if response.StatusCode != 200 {
		return nil, fmt.Errorf("received status code %d from STS: %s", response.StatusCode, string(responseBody))
	}

	callerIdentity := &GetCallerIdentityResponse{}
	err = xml.NewDecoder(bytes.NewReader(responseBody)).Decode(callerIdentity)
	if err != nil {
		return nil, fmt.Errorf("decoding STS response: %v", err)
	}

	return callerIdentity, nil
}

// GetCallerIdentityV1 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV1(ctx context.Context, httpClient *http.Client, decoded awsV1Token) (*GetCallerIdentityResponse, error) {
	// Well-known V1 request body
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the request
2. Check for proxies truncating responses
3. Verify STS endpoint connectivity

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:421 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5fe0762ca2366c04. Report an issue: GitHub.