k3s-io/k3s · warning

method not allowed

Error message

method not allowed

What it means

TokenRequest in pkg/server/handlers/token.go serves /v1-k3s/token, the endpoint behind 'k3s token rotate'. It accepts only HTTP PUT; any other verb is rejected with HTTP 405 'method not allowed' before the JSON body is parsed.

Source

Thrown at pkg/server/handlers/token.go:38

type TokenRotateRequest struct {
	NewToken *string `json:"newToken,omitempty"`
}

func getServerTokenRequest(req *http.Request) (TokenRotateRequest, error) {
	b, err := io.ReadAll(req.Body)
	if err != nil {
		return TokenRotateRequest{}, err
	}
	result := TokenRotateRequest{}
	err = json.Unmarshal(b, &result)
	return result, err
}

func TokenRequest(ctx context.Context, control *config.Control) http.Handler {
	return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
		if req.Method != http.MethodPut {
			util.SendError(errors.New("method not allowed"), resp, req, http.StatusMethodNotAllowed)
			return
		}
		var err error
		sTokenReq, err := getServerTokenRequest(req)
		logrus.Debug("Received token request")
		if err != nil {
			util.SendError(err, resp, req, http.StatusBadRequest)
			return
		}
		if err = tokenRotate(ctx, control, *sTokenReq.NewToken); err != nil {
			util.SendErrorWithID(err, "token", resp, req, http.StatusInternalServerError)
			return
		}
		resp.WriteHeader(http.StatusOK)
	})
}

func WriteToken(token, file, certs string) error {

View on GitHub (pinned to 6ba341e396)

Solutions

1. Use PUT with a JSON body: curl -sk -X PUT -d '{"newToken":"..."}' https://server:6443/v1-k3s/token.
2. Prefer the CLI: 'k3s token rotate' (optionally 'k3s token rotate --new-token <token>').
3. Exclude /v1-k3s/token from generic GET-based checks.

Example fix

# before: 405
curl -sk https://127.0.0.1:6443/v1-k3s/token

# after: accepted
curl -sk -X PUT https://127.0.0.1:6443/v1-k3s/token -d '{"newToken":""}'

// Guard the verb before calling the token endpoint
if req.Method != http.MethodPut {
    return errors.New("token endpoint requires PUT")
}

if resp.StatusCode == http.StatusMethodNotAllowed {
    // re-send as PUT with a JSON body, or use 'k3s token rotate'
}

When it happens

Trigger: GET/POST to /v1-k3s/token - e.g. curl without -X PUT, a probe, or custom scripts using the wrong method.

Common situations: Manual token-rotation attempts via curl; monitoring scanning the supervisor port; wrappers that default to GET.

Related errors

• method not allowed
• method not allowed
• server token not found
• invalid username/password combination
• --token is required

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/24cb8fce89c561e2. Report an issue: GitHub.