kubernetes/kops · error

decoding authorization token: %v

Error message

decoding authorization token: %v

What it means

The node's bootstrap token (v2 format) could not be base64-decoded after stripping the AWS token prefix: the token bytes are not valid StdEncoding base64, typically because the token was truncated, re-encoded, or prefixed twice.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:218

	}
	if amzCredential == "" {
		return nil, fmt.Errorf("unexpected credential value")
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

func (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %v", err)
	}
	var decoded awsV2Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %v", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	if decoded.SignedHeader.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %v", err)
	}
	signedHeaders := sets.New(strings.Split(reqURL.Query().Get("X-Amz-SignedHeaders"), ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the token is passed through unmodified (no shell/env truncation or duplicated prefixes)
2. Confirm both sides use base64 StdEncoding and the same AWSAuthenticationTokenPrefixV2
3. Regenerate the token on the node if it was corrupted in transit

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:218 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/14640f89552bd510. Report an issue: GitHub.