k3s-io/k3s · error

invalid username/password combination

Error message

invalid username/password combination

What it means

The basicauth authenticator extracts the Authorization: Basic header and delegates to a Password authenticator. If the password check completes without an internal error but the credentials are simply wrong (ok == false, err == nil), it substitutes this default error so callers get a meaningful 401 cause instead of a bare 'not authenticated'. Not-found headers return no error at all, so this error specifically means bad credentials were presented.

Source

Thrown at pkg/authenticator/basicauth/basicauth.go:36

import (
	"errors"
	"net/http"

	"k8s.io/apiserver/pkg/authentication/authenticator"
)

// Authenticator authenticates requests using basic auth
type Authenticator struct {
	auth Password
}

// New returns a request authenticator that validates credentials using the provided password authenticator
func New(auth Password) *Authenticator {
	return &Authenticator{auth}
}

var errInvalidAuth = errors.New("invalid username/password combination")

// AuthenticateRequest authenticates the request using the "Authorization: Basic" header in the request
func (a *Authenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
	username, password, found := req.BasicAuth()
	if !found {
		return nil, false, nil
	}

	resp, ok, err := a.auth.AuthenticatePassword(req.Context(), username, password)

	// If the password authenticator didn't error, provide a default error
	if !ok && err == nil {
		err = errInvalidAuth
	}

	return resp, ok, err
}

View on GitHub (pinned to 6ba341e396)

Solutions

1. Correct the credentials (update kubeconfig users, curl -u, or CI secrets) to the current username/password
2. If credentials were lost, reset/reissue them through the cluster's user management rather than retrying
3. Prefer token-based auth (K3S_TOKEN / bearer tokens) for automation to avoid stale basic-auth caches

Example fix

# before
curl -u admin:wrongpass -k https://127.0.0.1:6443/... # -> invalid username/password combination

# after
curl -u admin:$(cat current-pass) -k https://127.0.0.1:6443/...

resp, ok, err := authn.AuthenticateRequest(req)
if err != nil {
    if errors.Is(err, basicauth.ErrInvalidAuth) || err.Error() == "invalid username/password combination" {
        http.Error(w, "401 Unauthorized", http.StatusUnauthorized) // do not leak which part failed
        return
    }
    http.Error(w, "500 Internal Server Error", http.StatusInternalServerError)
}

When it happens

Trigger: Calling a k3s supervisor API endpoint guarded by basic auth with a wrong username or password: kubectl --username/--password against the supervisor, curl -u with stale creds, or automation using rotated credentials.

Common situations: Password rotated on the cluster but cached in kubeconfig/kubectl; CI secrets out of date; typos in username/password; using the wrong user for the endpoint.

Related errors

• header node name does not match auth node name
• auth user not set
• method not allowed
• insufficient PSK bytes
• all servers failed

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/72ea31d0b73a834f. Report an issue: GitHub.