k3s-io/k3s · error

node name not set

Error message

node name not set

What it means

Node-password auth requires two headers: <program>-Node-Name (e.g. k3s-Node-Name) and <program>-Node-Password. This variant fires when the name header is absent or empty; the name is lowercased before use, but must be present.

Source

Thrown at pkg/nodepassword/validate.go:110

			return verifyRemotePassword(ctx, control, &mu, deferredNodes, node)
		}

		return node.Name, http.StatusOK, nil
	}
}

// getNodeInfo returns node name, password, and user extracted
// from request headers and context. An error is returned
// if any critical fields are missing.
func getNodeInfo(req *http.Request) (*nodeInfo, error) {
	user, ok := request.UserFrom(req.Context())
	if !ok {
		return nil, errors.New("auth user not set")
	}

	nodeName := req.Header.Get(version.Program + "-Node-Name")
	if nodeName == "" {
		return nil, errors.New("node name not set")
	}

	nodePassword := req.Header.Get(version.Program + "-Node-Password")
	if nodePassword == "" {
		return nil, errors.New("node password not set")
	}

	return &nodeInfo{
		Name:     strings.ToLower(nodeName),
		Password: nodePassword,
		User:     user,
	}, nil
}

// verifyLocalPassword is used to validate the local node's password secret directly against the node password file, when the apiserver is unavailable.
// This is only used early in startup, when a control-plane node's agent is starting up without a functional apiserver.
func verifyLocalPassword(ctx context.Context, control *config.Control, mu *sync.Mutex, deferredNodes map[string]bool, node *nodeInfo) (string, int, error) {
	// do not attempt to verify the node password if the local host is not running an agent and does not have a node resource.

View on GitHub (pinned to 6ba341e396)

Solutions

1. Send the header explicitly: -H 'k3s-Node-Name: <hostname>'.
2. Check intermediate proxies/ingress for custom-header stripping and allow k3s-Node-Name/k3s-Node-Password.
3. Align agent and server versions so the header set matches.

Example fix

# before
curl -H 'k3s-Node-Password: x' ...
# after
curl -H 'k3s-Node-Name: node1' -H 'k3s-Node-Password: x' ...

if req.Header.Get(version.Program+"-Node-Name") == "" {
    return errors.New("missing " + version.Program + "-Node-Name header")
}

When it happens

Trigger: A request reaches the node-password authenticator with the password header but without k3s-Node-Name; an agent/CLI from an incompatible version that only sends the password; a gateway that strips custom headers.

Common situations: Corporate proxies/LBs dropping unknown custom headers; scripts that set only the password header; version skew between agent and server during rolling upgrades.

Related errors

• node password not set
• password hash not found in node secret
• header node name does not match auth node name
• invalid username/password combination
• --token is required

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/f033e0839922fa40. Report an issue: GitHub.