k3s-io/k3s · error

auth user not set

Error message

auth user not set

What it means

getNodeInfo extracts the authenticated user from the request context via request.UserFrom; the node-password filter requires that upstream authentication has already run and stored a user. If the context carries no user (filter invoked on an unauthenticated path), the request fails immediately.

Source

Thrown at pkg/nodepassword/validate.go:105

			// allows nodes to join the cluster during outages caused by validating webhooks
			// blocking secret creation - if the outage requires new nodes to join in order to
			// run the webhook pods, we must fail open here to resolve the outage.
			// ref: github.com/k3s-io/k3s/issues/7654
			logrus.Warnf("Failed to ensure node-password secret for node %s: %v", node.Name, err)
			return verifyRemotePassword(ctx, control, &mu, deferredNodes, node)
		}

		return node.Name, http.StatusOK, nil
	}
}

// getNodeInfo returns node name, password, and user extracted
// from request headers and context. An error is returned
// if any critical fields are missing.
func getNodeInfo(req *http.Request) (*nodeInfo, error) {
	user, ok := request.UserFrom(req.Context())
	if !ok {
		return nil, errors.New("auth user not set")
	}

	nodeName := req.Header.Get(version.Program + "-Node-Name")
	if nodeName == "" {
		return nil, errors.New("node name not set")
	}

	nodePassword := req.Header.Get(version.Program + "-Node-Password")
	if nodePassword == "" {
		return nil, errors.New("node password not set")
	}

	return &nodeInfo{
		Name:     strings.ToLower(nodeName),
		Password: nodePassword,
		User:     user,
	}, nil
}

View on GitHub (pinned to 6ba341e396)

Solutions

1. Send node-password requests through the authenticated flow (port 6443 with Authorization header / client certs), not to a plain HTTP listener.
2. Verify the request carries credentials (Authorization: Bearer ... or client cert) before it reaches this code.
3. If you maintain a custom filter chain, ensure the authentication filter runs before node-password verification.

Example fix

# before: anonymous request, no authn context
curl http://node:6443/... -H 'k3s-Node-Name: node1' -H 'k3s-Node-Password: x'
# after: authenticated request
curl -u node1:'password' https://node:6443/... -H 'k3s-Node-Name: node1' -H 'k3s-Node-Password: x'

// ensure authn has run before invoking node-password filter
if _, ok := request.UserFrom(req.Context()); !ok {
    return errors.New("request not authenticated; send Authorization header or client cert")
}

When it happens

Trigger: The node-password authentication handler runs on a request that never passed the authentication filter - e.g. a miswired filter chain, a request sent to a port/path where authn is disabled, or a code change that reordered filters.

Common situations: Custom proxies or ingress stripping the authentication context; integration tests hitting the authn webhook directly; upgrades that changed the apiserver filter chain order.

Related errors

• invalid username/password combination
• not authorized
• method not allowed
• --token is required
• etcd datastore disabled

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/894772ae9db90574. Report an issue: GitHub.