juicedata/juicefs · error

error decoding Base64 encoded data %s

Error message

error decoding Base64 encoded data %s

What it means

getKerberosClient reads an optional Base64-encoded keytab from the KRB5KEYTAB-style env var. If base64.StdEncoding.DecodeString fails, the raw env value is not valid Base64 and the error is wrapped as "error decoding Base64 encoded data %s". The Kerberos client cannot proceed without the keytab.

Source

Thrown at pkg/object/hdfs_kerberos.go:48

		return nil, err
	}

	disablePAFXFAST := os.Getenv("KRB5_DISABLE_PA_FX_FAST") == "true"
	var krbSettings []func(*krb.Settings)
	if disablePAFXFAST {
		krbSettings = append(krbSettings, krb.DisablePAFXFAST(true))
	}

	// Try to authenticate with keytab file first.
	keytabPath := os.Getenv("KRB5KEYTAB")
	keytabBase64 := os.Getenv("KRB5KEYTAB_BASE64")
	principal := os.Getenv("KRB5PRINCIPAL")

	var kt *keytab.Keytab
	if keytabBase64 != "" {
		decodedKeytab, err := base64.StdEncoding.DecodeString(keytabBase64)
		if err != nil {
			return nil, fmt.Errorf("error decoding Base64 encoded data %s", err)
		}
		kt = new(keytab.Keytab)
		err = kt.Unmarshal(decodedKeytab)
		if err != nil {
			return nil, err
		}
	} else if keytabPath != "" {
		kt, err = keytab.Load(keytabPath)
		if err != nil {
			return nil, err
		}
	}
	if kt != nil {
		// e.g. KRB5PRINCIPAL="primary/instance@realm"
		sp := strings.Split(principal, "@")
		if len(sp) != 2 {
			return nil, fmt.Errorf("unusable kerberos principal: %s", principal)
		}

View on GitHub (pinned to c9a67b23e8)

Solutions

  1. Regenerate the value with standard single-line Base64: base64 -w0 /path/to/keytab and set the env var to that exact output.
  2. Strip whitespace/newlines/quotes from the env value.
  3. Validate it decodes locally: echo "$KEYTAB_B64" | base64 -d > /tmp/kt && klist -kte /tmp/kt.
  4. If you meant to reference a file, use the plain file-path env var instead of the Base64 one.

Example fix

// before
export KRB5KEYTAB_BASE64=$(base64 /etc/keytabs/juicefs.keytab)   # multi-line, contains newlines
// after
export KRB5KEYTAB_BASE64=$(base64 -w0 /etc/keytabs/juicefs.keytab)
Defensive patterns

Strategy: validation

Validate before calling

b64 := os.Getenv("KRB5KEYTAB_BASE64")
if b64 != "" {
    cleaned := strings.Map(func(r rune) rune {
        if r == '\n' || r == '\r' || r == ' ' { return -1 }
        return r
    }, b64)
    if _, err := base64.StdEncoding.DecodeString(cleaned); err != nil {
        return fmt.Errorf("KRB5KEYTAB_BASE64 is not valid std Base64: %w", err)
    }
}

Try / catch

if err != nil && strings.Contains(err.Error(), "error decoding Base64") {
    logger.Fatalf("Keytab env var is not valid Base64: %v — regenerate with base64 -w0", err)
}

Prevention

When it happens

Trigger: KRB5KEYTAB_BASE64 (keytabBase64) set to a value that is not valid standard Base64 — whitespace/newlines inside the value, URL-safe Base64 used instead of StdEncoding, quoted or partially truncated value, or an actual file path pasted instead of the encoded contents.

Common situations: Kubernetes secret mounted with line wraps; base64 -w0 not used when generating the value; confusing a keytab file path with its Base64 content; URL-safe encoding from another tool.

Understand the failure class

Background: "is not a valid" / "Invalid ... value" environment variable errors: how libraries validate env vars and what to do when they reject yours — this error's family across 48 libraries.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/61b6108d5f1a8c42. Report an issue: GitHub.