kubernetes/kops · error

empty PKCS7 signature

Error message

empty PKCS7 signature

What it means

Guard error in parseAndValidatePKCS7Signer: the decoded token's PKCS7 signature blob is empty, so there is nothing to parse or verify. The client sent a well-formed token prefix with an empty payload.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:235

	intermediateCerts, err := fetchIntermediates(signer)
	if err != nil {
		return nil, fmt.Errorf("fetching intermediate certificates: %w", err)
	}
	if err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {
		return nil, fmt.Errorf("verifying PKCS7 certificate chain: %w", err)
	}
	klog.V(4).Infof("PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q", signer.Issuer)

	return data, nil
}

// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its
// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata
// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call
// before triggering intermediate certificate fetches.
func parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {
	if signature == "" {
		return nil, nil, fmt.Errorf("empty PKCS7 signature")
	}

	sigBytes, err := base64.StdEncoding.DecodeString(signature)
	if err != nil {
		return nil, nil, fmt.Errorf("decoding PKCS7 signature: %w", err)
	}
	klog.V(4).Infof("Decoded PKCS7 signature (%d bytes)", len(sigBytes))

	p7, err := pkcs7.Parse(sigBytes)
	if err != nil {
		return nil, nil, fmt.Errorf("parsing PKCS7 signature: %w", err)
	}
	klog.V(8).Infof("Parsed PKCS7 structure with %d embedded certificate(s)", len(p7.Certificates))

	// Verify the PKCS7 signature against the embedded leaf certificate.
	if err := p7.Verify(); err != nil {
		return nil, nil, fmt.Errorf("verifying PKCS7 signature: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the bootstrap token
2. Regenerate the token on the node (restart nodeup / kubelet bootstrap attempt) so a full signature is sent

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:235 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aa2761ba4fb06aae. Report an issue: GitHub.