{"record":{"id":"9afa41b847d3da36","repo":"kubernetes/kops","slug":"unable-to-verify-token","errorCode":null,"errorMessage":"unable to verify token","messagePattern":"unable to verify token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/chain.go","lineNumber":52,"sourceCode":"\tchain []Verifier\n}\n\n// VerifyToken will return the first positive verification from any Verifier in the chain.\nfunc (v *ChainVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*VerifyResult, error) {\n\tfor _, verifier := range v.chain {\n\t\tresult, err := verifier.VerifyToken(ctx, rawRequest, token, body)\n\t\tif err == nil {\n\t\t\treturn result, nil\n\t\t}\n\t\tif err == ErrNotThisVerifier {\n\t\t\tcontinue\n\t\t}\n\t\tif err == ErrAlreadyExists {\n\t\t\treturn nil, ErrAlreadyExists\n\t\t}\n\t\tklog.Infof(\"failed to verify token: %v\", err)\n\t}\n\treturn nil, fmt.Errorf(\"unable to verify token\")\n}\n","sourceCodeStart":34,"sourceCodeEnd":54,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/chain.go#L34-L54","documentation":"VerifyToken iterates all registered Verifiers and, when every one fails to validate the bearer token, returns this generic sentinel error. The per-verifier causes are logged via klog.Infof ('failed to verify token') but are not included in the returned error, so callers only see the aggregate failure. It means no bootstrap verifier accepted the token (e.g. no AWS verifier for an AWS-signed request, or STS validation failed).","triggerScenarios":"A node sends a bootstrap request with a token that every configured verifier rejects: wrong cluster for the verifier, the AWS verifier is not registered for this cloud, expired/invalid presigned STS token, or token signed for a different cluster name.","commonSituations":"Node bootstrapping against the wrong API server/cluster; kops server missing the cloud-specific verifier registration; clock skew invalidating presigned URLs; node using a token format from a different kops version.","solutions":["Check the klog server logs for the preceding 'failed to verify token: %v' line to find the real per-verifier cause","Confirm the correct verifier (e.g. AWS verifier) is registered for the cluster's cloud in the bootstrap server setup","Verify the node is targeting the correct cluster name and API endpoint","Check system clock skew on nodes and server, which breaks presigned STS URLs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"resp, err := client.VerifyToken(ctx, req)\nif err != nil {\n  if errors.Is(err, bootstrap.ErrAlreadyExists) { /* already registered */ }\n  klog.Errorf(\"bootstrap token rejected: %v — check server klog for per-verifier cause\", err)\n  return err\n}","preventionTips":["Read the server klog line 'failed to verify token: ...' for the underlying cause","Verify the node targets the correct cluster and the matching verifier is registered","Keep node and server clocks in sync (NTP) so presigned STS tokens validate"],"tags":["bootstrap","auth","token","kops"],"backgroundTag":"token-verification-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}