kubernetes/kops · error

decoding authorization token: %w

Error message

decoding authorization token: %w

What it means

The bearer token presented to the PKI verifier is not valid base64 after its expected prefix was stripped: the prefix matched (so this verifier was selected) but the payload is malformed — truncated, re-encoded, or carrying extra characters.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:74

	}
	return &verifier{
		opt:    opt,
		client: client,
	}, nil
}

var _ bootstrap.Verifier = &verifier{}

// TODO: Dedup with gce
func (v *verifier) parseTokenData(tokenPrefix string, authToken string, body []byte) (*pkibootstrap.AuthToken, *pkibootstrap.AuthTokenData, error) {
	if !strings.HasPrefix(authToken, tokenPrefix) {
		return nil, nil, bootstrap.ErrNotThisVerifier
	}
	authToken = strings.TrimPrefix(authToken, tokenPrefix)

	tokenBytes, err := base64.StdEncoding.DecodeString(authToken)
	if err != nil {
		return nil, nil, fmt.Errorf("decoding authorization token: %w", err)
	}

	token := &pkibootstrap.AuthToken{}
	if err = json.Unmarshal(tokenBytes, token); err != nil {
		return nil, nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	tokenData := &pkibootstrap.AuthTokenData{}
	if err := json.Unmarshal(token.Data, tokenData); err != nil {
		return nil, nil, fmt.Errorf("unmarshalling authorization token data: %w", err)
	}

	// Guard against replay attacks
	if tokenData.Audience != pkibootstrap.AudienceNodeAuthentication {
		return nil, nil, fmt.Errorf("incorrect Audience")
	}
	timeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())
	if timeSkew > float64(v.opt.MaxTimeSkew) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the token is forwarded intact (no truncation or double encoding)
2. Ensure the client uses the same base64 alphabet (StdEncoding) as the verifier
3. Re-issue the token from the node

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/90c49d586e8ad81c. Report an issue: GitHub.