kubernetes/kops · error

attested document createdOn %s is older than allowed freshne

Error message

attested document createdOn %s is older than allowed freshness window of %s plus %s clock skew

What it means

Freshness check: createdOn is older than attestedDocumentMaxAge plus the allowed clock skew, so a replayed old attestation is being presented. The window parameters in the message show the exact thresholds applied.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:310

	expectedNonce := nonceForBody(body)
	if data.Nonce != expectedNonce {
		return nil, fmt.Errorf("attested document nonce mismatch: got=%q expected=%q", data.Nonce, expectedNonce)
	}

	now := time.Now().UTC()
	if data.TimeStamp.CreatedOn == "" {
		return nil, fmt.Errorf("attested document createdOn is required")
	}
	createdOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.CreatedOn)
	if err != nil {
		return nil, fmt.Errorf("parsing attested document creation: %w", err)
	}
	if createdOn.After(now.Add(attestedDocumentMaxClockSkew)) {
		return nil, fmt.Errorf("attested document createdOn %s is too far in the future", data.TimeStamp.CreatedOn)
	}
	oldestAllowedCreatedOn := now.Add(-(attestedDocumentMaxAge + attestedDocumentMaxClockSkew))
	if createdOn.Before(oldestAllowedCreatedOn) {
		return nil, fmt.Errorf("attested document createdOn %s is older than allowed freshness window of %s plus %s clock skew", data.TimeStamp.CreatedOn, attestedDocumentMaxAge, attestedDocumentMaxClockSkew)
	}
	klog.V(4).Infof("Attested document createdOn is fresh (createdOn=%s now=%s)", createdOn.Format(time.RFC3339), now.Format(time.RFC3339))

	// Verify the attested document has not expired and has a coherent lifetime.
	if data.TimeStamp.ExpiresOn != "" {
		expiresOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.ExpiresOn)
		if err != nil {
			return nil, fmt.Errorf("parsing attested document expiration: %w", err)
		}
		if expiresOn.Before(createdOn) {
			return nil, fmt.Errorf("attested document expiresOn %s is before createdOn %s", data.TimeStamp.ExpiresOn, data.TimeStamp.CreatedOn)
		}
		if expiresOn.Before(now.Add(-attestedDocumentMaxClockSkew)) {
			return nil, fmt.Errorf("attested document expired at %s", data.TimeStamp.ExpiresOn)
		}
		klog.V(4).Infof("Attested document not expired (expiresOn=%s)", expiresOn.Format(time.RFC3339))
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the bootstrap request; the token is stale/replayed
2. Have the node obtain a fresh attestation from IMDS and retry
3. Check for paused VMs or severe clock drift on the node

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:310 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/92ad863c54f2df80. Report an issue: GitHub.