{"record":{"id":"339014789462be1c","repo":"k3s-io/k3s","slug":"server-token-not-found","errorCode":null,"errorMessage":"server token not found","messagePattern":"server token not found","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/server/handlers/token.go","lineNumber":76,"sourceCode":"\t\treturn nil\n\t}\n\n\ttoken, err := clientaccess.FormatToken(token, certs)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn os.WriteFile(file, []byte(token+\"\\n\"), 0600)\n}\n\nfunc tokenRotate(ctx context.Context, control *config.Control, newToken string) error {\n\tpasswd, err := passwd.Read(control.Runtime.PasswdFile)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\toldToken, found := passwd.Pass(\"server\")\n\tif !found {\n\t\treturn errors.New(\"server token not found\")\n\t}\n\tif newToken == \"\" {\n\t\tnewToken, err = util.Random(16)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tif newToken, err = util.NormalizeToken(newToken); err != nil {\n\t\treturn err\n\t}\n\n\tif err := passwd.EnsureUser(\"server\", version.Program+\":server\", newToken); err != nil {\n\t\treturn err\n\t}\n\n\t// If the agent token is the same a server, we need to change both\n\tif agentToken, found := passwd.Pass(\"node\"); found && agentToken == oldToken && control.AgentToken == \"\" {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/token.go#L58-L94","documentation":"tokenRotate in pkg/server/handlers/token.go reads the server's passwd file (control.Runtime.PasswdFile, by default /var/lib/rancher/k3s/server/cred/passwd) and looks up the entry named 'server'. If no 'server' user exists in that file, rotation aborts with 'server token not found' because there is no current token to swap.","triggerScenarios":"'k3s token rotate' (PUT /v1-k3s/token) on a server whose passwd file is missing, truncated, or lacks a line starting with 'server:' - e.g. after manual deletion, a partial restore, or copying cred/ files between nodes incorrectly.","commonSituations":"Operators pruning or regenerating files under server/cred; backups restored without the passwd file; mixing credential files from different installs.","solutions":["Inspect the file: grep '^server:' /var/lib/rancher/k3s/server/cred/passwd - it must contain the server entry (format: 'server:<token>,<groups>').","Restore the passwd file from a backup of /var/lib/rancher/k3s/server/cred/.","If no backup exists, restore from a snapshot or etcd backup of the node's credentials rather than hand-crafting tokens.","After the file is intact, retry 'k3s token rotate'."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Before rotating, confirm the server entry exists\ngrep -q '^server:' /var/lib/rancher/k3s/server/cred/passwd || echo 'passwd file lacks server entry'","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"server token not found\") {\n    // halt rotation, restore server/cred/passwd from backup, retry\n}","preventionTips":["Never delete or prune files under /var/lib/rancher/k3s/server/cred/.","Back up cred/ before token operations.","Restore credentials as a unit; do not mix files from different installs."],"tags":["k3s","token","credentials","file-corruption","authentication"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}