kubernetes/kops · error

parsing attested document expiration: %w

Error message

parsing attested document expiration: %w

What it means

The expiresOn timestamp of the attested document does not conform to the expected attestedDocumentTimeFormat, so document expiry cannot be evaluated. Malformed timestamp in the signed payload.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:318

	}
	createdOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.CreatedOn)
	if err != nil {
		return nil, fmt.Errorf("parsing attested document creation: %w", err)
	}
	if createdOn.After(now.Add(attestedDocumentMaxClockSkew)) {
		return nil, fmt.Errorf("attested document createdOn %s is too far in the future", data.TimeStamp.CreatedOn)
	}
	oldestAllowedCreatedOn := now.Add(-(attestedDocumentMaxAge + attestedDocumentMaxClockSkew))
	if createdOn.Before(oldestAllowedCreatedOn) {
		return nil, fmt.Errorf("attested document createdOn %s is older than allowed freshness window of %s plus %s clock skew", data.TimeStamp.CreatedOn, attestedDocumentMaxAge, attestedDocumentMaxClockSkew)
	}
	klog.V(4).Infof("Attested document createdOn is fresh (createdOn=%s now=%s)", createdOn.Format(time.RFC3339), now.Format(time.RFC3339))

	// Verify the attested document has not expired and has a coherent lifetime.
	if data.TimeStamp.ExpiresOn != "" {
		expiresOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.ExpiresOn)
		if err != nil {
			return nil, fmt.Errorf("parsing attested document expiration: %w", err)
		}
		if expiresOn.Before(createdOn) {
			return nil, fmt.Errorf("attested document expiresOn %s is before createdOn %s", data.TimeStamp.ExpiresOn, data.TimeStamp.CreatedOn)
		}
		if expiresOn.Before(now.Add(-attestedDocumentMaxClockSkew)) {
			return nil, fmt.Errorf("attested document expired at %s", data.TimeStamp.ExpiresOn)
		}
		klog.V(4).Infof("Attested document not expired (expiresOn=%s)", expiresOn.Format(time.RFC3339))
	}

	return &data, nil
}

// intermediateCertPoolWithCaches performs a cached lookup against the supplied positive and
// negative TTL caches, invoking fetch on a miss. Tests inject their own stores and fetchers.
func intermediateCertPoolWithCaches(signer *x509.Certificate, fetch func(*x509.Certificate) (*x509.CertPool, error), positive, negative expirationcache.Store) (*x509.CertPool, error) {
	if signer == nil {
		return nil, fmt.Errorf("signer certificate is required")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation token
2. Update kOps if Azure changed the timestamp format

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:318 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b92d035d60894d7f. Report an issue: GitHub.