kubernetes/kops · error

sending STS request: %v

Error message

sending STS request: %v

What it means

Wraps a failure of httpClient.Do in getCallerIdentityV2: the verifier could not complete the HTTP request that replays the presigned STS URL (network error, DNS, TLS), so the caller identity cannot be fetched.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:413

// getCallerIdentityV2 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV2(ctx context.Context, httpClient *http.Client, decoded *awsV2Token) (*GetCallerIdentityResponse, error) {
	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %w", err)
	}

	if !s.isValidV2(reqURL) {
		return nil, fmt.Errorf("url not valid for STS request")
	}

	req := &http.Request{
		URL:    reqURL,
		Method: decoded.Method,
		Header: decoded.SignedHeader,
	}
	response, err := httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		return nil, fmt.Errorf("reading STS response: %v", err)
	}
	if response.StatusCode != 200 {
		return nil, fmt.Errorf("received status code %d from STS: %s", response.StatusCode, string(responseBody))
	}

	callerIdentity := &GetCallerIdentityResponse{}
	err = xml.NewDecoder(bytes.NewReader(responseBody)).Decode(callerIdentity)
	if err != nil {
		return nil, fmt.Errorf("decoding STS response: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify network access to sts.amazonaws.com from nodes
2. Check DNS and TLS configuration
3. Retry the bootstrap request

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:413 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2a7eca9dc685e447. Report an issue: GitHub.