{"record":{"id":"61b6108d5f1a8c42","repo":"juicedata/juicefs","slug":"error-decoding-base64-encoded-data-s","errorCode":null,"errorMessage":"error decoding Base64 encoded data %s","messagePattern":"error decoding Base64 encoded data (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/hdfs_kerberos.go","lineNumber":48,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tdisablePAFXFAST := os.Getenv(\"KRB5_DISABLE_PA_FX_FAST\") == \"true\"\n\tvar krbSettings []func(*krb.Settings)\n\tif disablePAFXFAST {\n\t\tkrbSettings = append(krbSettings, krb.DisablePAFXFAST(true))\n\t}\n\n\t// Try to authenticate with keytab file first.\n\tkeytabPath := os.Getenv(\"KRB5KEYTAB\")\n\tkeytabBase64 := os.Getenv(\"KRB5KEYTAB_BASE64\")\n\tprincipal := os.Getenv(\"KRB5PRINCIPAL\")\n\n\tvar kt *keytab.Keytab\n\tif keytabBase64 != \"\" {\n\t\tdecodedKeytab, err := base64.StdEncoding.DecodeString(keytabBase64)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding Base64 encoded data %s\", err)\n\t\t}\n\t\tkt = new(keytab.Keytab)\n\t\terr = kt.Unmarshal(decodedKeytab)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t} else if keytabPath != \"\" {\n\t\tkt, err = keytab.Load(keytabPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tif kt != nil {\n\t\t// e.g. KRB5PRINCIPAL=\"primary/instance@realm\"\n\t\tsp := strings.Split(principal, \"@\")\n\t\tif len(sp) != 2 {\n\t\t\treturn nil, fmt.Errorf(\"unusable kerberos principal: %s\", principal)\n\t\t}","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/hdfs_kerberos.go#L30-L66","documentation":"getKerberosClient reads an optional Base64-encoded keytab from the KRB5KEYTAB-style env var. If base64.StdEncoding.DecodeString fails, the raw env value is not valid Base64 and the error is wrapped as \"error decoding Base64 encoded data %s\". The Kerberos client cannot proceed without the keytab.","triggerScenarios":"KRB5KEYTAB_BASE64 (keytabBase64) set to a value that is not valid standard Base64 — whitespace/newlines inside the value, URL-safe Base64 used instead of StdEncoding, quoted or partially truncated value, or an actual file path pasted instead of the encoded contents.","commonSituations":"Kubernetes secret mounted with line wraps; base64 -w0 not used when generating the value; confusing a keytab file path with its Base64 content; URL-safe encoding from another tool.","solutions":["Regenerate the value with standard single-line Base64: base64 -w0 /path/to/keytab and set the env var to that exact output.","Strip whitespace/newlines/quotes from the env value.","Validate it decodes locally: echo \"$KEYTAB_B64\" | base64 -d > /tmp/kt && klist -kte /tmp/kt.","If you meant to reference a file, use the plain file-path env var instead of the Base64 one."],"exampleFix":"// before\nexport KRB5KEYTAB_BASE64=$(base64 /etc/keytabs/juicefs.keytab)   # multi-line, contains newlines\n// after\nexport KRB5KEYTAB_BASE64=$(base64 -w0 /etc/keytabs/juicefs.keytab)","handlingStrategy":"validation","validationCode":"b64 := os.Getenv(\"KRB5KEYTAB_BASE64\")\nif b64 != \"\" {\n    cleaned := strings.Map(func(r rune) rune {\n        if r == '\\n' || r == '\\r' || r == ' ' { return -1 }\n        return r\n    }, b64)\n    if _, err := base64.StdEncoding.DecodeString(cleaned); err != nil {\n        return fmt.Errorf(\"KRB5KEYTAB_BASE64 is not valid std Base64: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error decoding Base64\") {\n    logger.Fatalf(\"Keytab env var is not valid Base64: %v — regenerate with base64 -w0\", err)\n}","preventionTips":["Generate values with base64 -w0 (no line wrapping).","Trim whitespace/newlines/quotes before setting the env var in manifests.","Never paste a file path where Base64 content is expected.","Decode-and-klist the value in CI to validate secrets."],"tags":["hdfs","kerberos","base64","environment-variable"],"backgroundTag":"invalid-env-var-value","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}