kubernetes/kops · error

decoding authorization token: %w

Error message

decoding authorization token: %w

What it means

Wraps a failure of base64.StdEncoding.DecodeString in verifyTokenV1: the body of the token after the 'kOpsAwsV1' prefix is not valid base64, so the embedded headers cannot be recovered for verification.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:154

}

func (a awsVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if strings.HasPrefix(token, AWSAuthenticationTokenPrefixV1) {
		return a.verifyTokenV1(ctx, token, body, a.verifyCallerIdentity)
	}
	if strings.HasPrefix(token, AWSAuthenticationTokenPrefixV2) {
		return a.verifyTokenV2(ctx, token, body, a.verifyCallerIdentity)
	}

	return nil, bootstrap.ErrNotThisVerifier
}

func (a awsVerifier) verifyTokenV1(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV1)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %w", err)
	}
	var decoded awsV1Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	decodedHeaders := http.Header(decoded)

	if decodedHeaders.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	authorization := decodedHeaders.Get("Authorization")
	if !strings.HasPrefix(authorization, "AWS4-HMAC-SHA256 ") {
		return nil, fmt.Errorf("incorrect authorization algorithm")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the client sends standard base64 with padding
2. Check token generation in kops nodeup/bootstrap client code
3. Re-bootstrap the node to regenerate the token

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:154 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/192febbc67165366. Report an issue: GitHub.