{"record":{"id":"f033e0839922fa40","repo":"k3s-io/k3s","slug":"node-name-not-set","errorCode":null,"errorMessage":"node name not set","messagePattern":"node name not set","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/nodepassword/validate.go","lineNumber":110,"sourceCode":"\t\t\treturn verifyRemotePassword(ctx, control, &mu, deferredNodes, node)\n\t\t}\n\n\t\treturn node.Name, http.StatusOK, nil\n\t}\n}\n\n// getNodeInfo returns node name, password, and user extracted\n// from request headers and context. An error is returned\n// if any critical fields are missing.\nfunc getNodeInfo(req *http.Request) (*nodeInfo, error) {\n\tuser, ok := request.UserFrom(req.Context())\n\tif !ok {\n\t\treturn nil, errors.New(\"auth user not set\")\n\t}\n\n\tnodeName := req.Header.Get(version.Program + \"-Node-Name\")\n\tif nodeName == \"\" {\n\t\treturn nil, errors.New(\"node name not set\")\n\t}\n\n\tnodePassword := req.Header.Get(version.Program + \"-Node-Password\")\n\tif nodePassword == \"\" {\n\t\treturn nil, errors.New(\"node password not set\")\n\t}\n\n\treturn &nodeInfo{\n\t\tName:     strings.ToLower(nodeName),\n\t\tPassword: nodePassword,\n\t\tUser:     user,\n\t}, nil\n}\n\n// verifyLocalPassword is used to validate the local node's password secret directly against the node password file, when the apiserver is unavailable.\n// This is only used early in startup, when a control-plane node's agent is starting up without a functional apiserver.\nfunc verifyLocalPassword(ctx context.Context, control *config.Control, mu *sync.Mutex, deferredNodes map[string]bool, node *nodeInfo) (string, int, error) {\n\t// do not attempt to verify the node password if the local host is not running an agent and does not have a node resource.","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/nodepassword/validate.go#L92-L128","documentation":"Node-password auth requires two headers: <program>-Node-Name (e.g. k3s-Node-Name) and <program>-Node-Password. This variant fires when the name header is absent or empty; the name is lowercased before use, but must be present.","triggerScenarios":"A request reaches the node-password authenticator with the password header but without k3s-Node-Name; an agent/CLI from an incompatible version that only sends the password; a gateway that strips custom headers.","commonSituations":"Corporate proxies/LBs dropping unknown custom headers; scripts that set only the password header; version skew between agent and server during rolling upgrades.","solutions":["Send the header explicitly: -H 'k3s-Node-Name: <hostname>'.","Check intermediate proxies/ingress for custom-header stripping and allow k3s-Node-Name/k3s-Node-Password.","Align agent and server versions so the header set matches."],"exampleFix":"# before\ncurl -H 'k3s-Node-Password: x' ...\n# after\ncurl -H 'k3s-Node-Name: node1' -H 'k3s-Node-Password: x' ...","handlingStrategy":"validation","validationCode":"if req.Header.Get(version.Program+\"-Node-Name\") == \"\" {\n    return errors.New(\"missing \" + version.Program + \"-Node-Name header\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure proxies/LBs to pass k3s-Node-* (or program-prefixed) headers.","Keep agent and server versions aligned during rolling upgrades."],"tags":["authentication","http-headers","node"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}