kubernetes/kops · error

incorrect SHA

Error message

incorrect SHA

What it means

Verification guard in verifyTokenV1: the X-Kops-Request-SHA header inside the token does not match the SHA-256 of the presented request body, so the request body was not signed by this token and the request is rejected as unauthenticated.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:166

func (a awsVerifier) verifyTokenV1(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV1)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %w", err)
	}
	var decoded awsV1Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	decodedHeaders := http.Header(decoded)

	if decodedHeaders.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	authorization := decodedHeaders.Get("Authorization")
	if !strings.HasPrefix(authorization, "AWS4-HMAC-SHA256 ") {
		return nil, fmt.Errorf("incorrect authorization algorithm")
	}

	amzSignature := ""
	amzCredential := ""
	amzSignedHeaders := ""

	for _, token := range strings.Split(strings.TrimPrefix(authorization, "AWS4-HMAC-SHA256 "), ", ") {
		kv := strings.SplitN(token, "=", 2)
		if len(kv) == 1 {
			return nil, fmt.Errorf("incorrect authorization format")
		}
		got := kv[1]
		switch kv[0] {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the client signs the exact request body bytes
2. Check for middleware that rewrites the body
3. Use a matching kOps client version

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:166 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c016ff0edb10029. Report an issue: GitHub.