kubernetes/kops · error

incorrect token format

Error message

incorrect token format

What it means

Guard in VerifyToken: the token carries the Azure prefix but does not split into the expected 'x-azure-id <resourceID> <base64-signature>' three-part form, so the resource ID and signature cannot be extracted.

Source

Thrown at upup/pkg/fi/cloudup/azure/verifier.go:112

	case vmssVMResourceType:
		return res.Parent.Name + "/" + res.Name
	default:
		return res.ResourceType.String() + "/" + res.Name
	}
}

// VerifyToken validates the Azure attestation token, confirms the claimed VM through the Azure API,
// and returns the node bootstrap identity.
func (a azureVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, azuremetadata.AzureAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}

	// Token format: "x-azure-id <resourceID> <base64-pkcs7-signature>"
	tokenPayload := strings.TrimPrefix(token, azuremetadata.AzureAuthenticationTokenPrefix)
	resourceID, signature, ok := strings.Cut(tokenPayload, " ")
	if !ok || resourceID == "" || signature == "" {
		return nil, fmt.Errorf("incorrect token format")
	}

	// Parse the resource ID early to reject malformed tokens before expensive crypto.
	res, err := arm.ParseResourceID(resourceID)
	if err != nil {
		return nil, fmt.Errorf("parsing resource ID: %w", err)
	}
	vmLogID := vmLogIDFromResource(res)
	resourceType := res.ResourceType.String()
	klog.V(4).Infof("Azure verifier for VM %q parsed resource ID: subscription=%q resourceGroup=%q", vmLogID, res.SubscriptionID, res.ResourceGroupName)

	// Reject resource IDs outside the verifier's own subscription / resource group. The Azure API lookup below
	// is already scoped to kops-controller's subscription and resource group, so any claim that names a different
	// location cannot describe a cluster VM. Failing here avoids a wasted Azure API call and makes the scope
	// explicit instead of implicit.
	if !strings.EqualFold(res.SubscriptionID, a.client.subscriptionID) {
		return nil, fmt.Errorf("resource ID subscription %q does not match verifier subscription %q", res.SubscriptionID, a.client.subscriptionID)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the bootstrap token
2. Regenerate the token on the node so the full three-part format is produced
3. Check for proxies or middleware truncating the Authorization header

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/verifier.go:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0d1b8be3e6b8911b. Report an issue: GitHub.