{"record":{"id":"5f2a3ad5fba64e6e","repo":"kubernetes/kops","slug":"failed-to-decode-user-data-w","errorCode":null,"errorMessage":"failed to decode user data: %w","messagePattern":"failed to decode user data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azuretasks/vmscaleset.go","lineNumber":186,"sourceCode":"\tif osProfile.LinuxConfiguration == nil {\n\t\treturn nil, fmt.Errorf(\"found VMSS without Linux config\")\n\t}\n\tif osProfile.LinuxConfiguration.SSH == nil {\n\t\treturn nil, fmt.Errorf(\"found VMSS without SSH config\")\n\t}\n\tif osProfile.LinuxConfiguration.SSH.PublicKeys == nil {\n\t\treturn nil, fmt.Errorf(\"found VMSS without SSH public keys\")\n\t}\n\tsshKeys := osProfile.LinuxConfiguration.SSH.PublicKeys\n\tif len(sshKeys) != 1 {\n\t\treturn nil, fmt.Errorf(\"expecting exactly 1 SSH key for %q, found %d: %+v\", *s.Name, len(sshKeys), sshKeys)\n\t}\n\n\tvar userData []byte\n\tif profile.UserData != nil {\n\t\tuserData, err = base64.StdEncoding.DecodeString(*profile.UserData)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to decode user data: %w\", err)\n\t\t}\n\t}\n\n\tvmss := &VMScaleSet{\n\t\tName:      s.Name,\n\t\tLifecycle: s.Lifecycle,\n\t\tResourceGroup: &ResourceGroup{\n\t\t\tName: s.ResourceGroup.Name,\n\t\t},\n\t\tVirtualNetwork: &VirtualNetwork{\n\t\t\tName: to.Ptr(subnetID.VirtualNetworkName),\n\t\t},\n\t\tSubnet: &Subnet{\n\t\t\tID: ipConfig.Properties.Subnet.ID,\n\t\t},\n\t\tStorageProfile: &VMScaleSetStorageProfile{\n\t\t\tVirtualMachineScaleSetStorageProfile: profile.StorageProfile,\n\t\t},","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azuretasks/vmscaleset.go#L168-L204","documentation":"Azure stores VMSS custom data base64-encoded. Find() decodes profile.userData with base64.StdEncoding; if the stored string is not valid base64, decoding fails and kOps wraps the decoder error with this message, since it cannot reconstruct the task's UserData resource.","triggerScenarios":"Find() on a VMSS whose virtualMachineProfile.osProfile.userData is non-nil but not valid standard base64 (e.g. URL-safe base64, raw text, or a corrupted value written by external tooling).","commonSituations":"User data written directly via ARM/CLI without base64 encoding; tools that use URL-safe encoding instead of standard; manual edits or migrations corrupting the value.","solutions":["Re-apply the node userdata through kops: `kops update cluster --yes` then `kops rolling-update cluster` so customData is re-encoded correctly.","If writing custom data yourself, always encode with standard base64: `base64.StdEncoding.EncodeToString(data)` (or `base64 -w0` in shell).","Inspect the raw value (`az vmss show ... --query \"virtualMachineProfile.osProfile.userData\"`) and check whether it is URL-safe base64; re-encode it.","Ensure any external provisioning tool uses the same standard encoding kOps expects."],"exampleFix":"// before (URL-safe / raw)\ncustomData = to.Ptr(base64.URLEncoding.EncodeToString(d))\n// after\ncustomData = to.Ptr(base64.StdEncoding.EncodeToString(d))","handlingStrategy":"validation","validationCode":"if _, err := base64.StdEncoding.DecodeString(fi.ValueOf(profile.UserData)); err != nil {\n  return fmt.Errorf(\"VMSS userdata is not valid standard base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"data, err := base64.StdEncoding.DecodeString(*profile.UserData)\nif err != nil {\n  return fmt.Errorf(\"kops: cannot decode VMSS userdata: %w\", err)\n}","preventionTips":["Always base64-encode custom data with StdEncoding before applying to Azure","Never write raw or URL-safe-encoded userdata directly via CLI/ARM","Reconcile userdata changes through kops rather than hand edits","Validate userdata encoding in external provisioning tools"],"tags":["azure","vmss","userdata","base64"],"backgroundTag":"base64-decode-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}