kubernetes/kops · error

unable to parse CNI plugin binaries asset hash %q: %v

Error message

unable to parse CNI plugin binaries asset hash %q: %v

What it means

When both CNI_VERSION_URL and CNI_ASSET_HASH_STRING env vars are set, FindCNIAssets converts CNI_ASSET_HASH_STRING via hashing.FromString, which expects a "<algorithm>:<hex>" format (e.g. sha256:<64 hex chars>). This error is thrown when the hash string cannot be parsed — wrong algorithm name, missing colon separator, or invalid hex.

Source

Thrown at pkg/nodemodel/wellknownassets/cni.go:70

)

func FindCNIAssets(ig model.InstanceGroup, assetBuilder *assets.AssetBuilder, arch architectures.Architecture) (*assets.FileAsset, error) {
	// Override CNI packages from env vars
	cniAssetURL := os.Getenv(ENV_VAR_CNI_ASSET_URL)
	cniAssetHash := os.Getenv(ENV_VAR_CNI_ASSET_HASH)

	if cniAssetURL != "" && cniAssetHash != "" {
		klog.V(2).Infof("Using CNI asset URL %q, as set in %s", cniAssetURL, ENV_VAR_CNI_ASSET_URL)
		klog.V(2).Infof("Using CNI asset hash %q, as set in %s", cniAssetHash, ENV_VAR_CNI_ASSET_HASH)

		u, err := url.Parse(cniAssetURL)
		if err != nil {
			return nil, fmt.Errorf("unable to parse CNI plugin binaries asset URL %q: %v", cniAssetURL, err)
		}

		h, err := hashing.FromString(cniAssetHash)
		if err != nil {
			return nil, fmt.Errorf("unable to parse CNI plugin binaries asset hash %q: %v", cniAssetHash, err)
		}

		asset, err := assetBuilder.RemapFile(u, h)
		if err != nil {
			return nil, fmt.Errorf("unable to remap CNI plugin binaries asset: %v", err)
		}

		return asset, nil
	}

	switch arch {
	case architectures.ArchitectureAmd64:
		switch {
		case ig.KubernetesVersion().IsGTE("1.36"):
			cniAssetURL = defaultCNIAssetAmd64K8s_36
		case ig.KubernetesVersion().IsGTE("1.35"):
			cniAssetURL = defaultCNIAssetAmd64K8s_35
		case ig.KubernetesVersion().IsGTE("1.34"):

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set CNI_ASSET_HASH_STRING in "sha256:<hex>" form, e.g. sha256:0e2a1a2c9b3d... (compute with `sha256sum <file>`)
2. Verify the hex portion is valid lowercase hex and matches the algorithm's expected length
3. If you don't need a custom hash override, unset CNI_ASSET_HASH_STRING (and CNI_VERSION_URL) to fall back to defaults

Example fix

// before
export CNI_ASSET_HASH_STRING="0e2a1a2c9b3d4e5f"
// after
export CNI_ASSET_HASH_STRING="sha256:0e2a1a2c9b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f"

h := os.Getenv("CNI_ASSET_HASH_STRING")
if h != "" {
    parts := strings.SplitN(h, ":", 2)
    if len(parts) != 2 {
        return fmt.Errorf("CNI_ASSET_HASH_STRING must be <algorithm>:<hex>, got %q", h)
    }
    if _, err := hex.DecodeString(parts[1]); err != nil {
        return fmt.Errorf("CNI_ASSET_HASH_STRING hex invalid: %w", err)
    }
}

func isAlgoPrefixedHash(s string) bool {
    i := strings.Index(s, ":")
    if i <= 0 || i == len(s)-1 {
        return false
    }
    _, err := hex.DecodeString(s[i+1:])
    return err == nil
}

if _, err := FindCNIAssets(ig, assetBuilder, arch); err != nil {
    if strings.Contains(err.Error(), "unable to parse CNI plugin binaries asset hash") {
        klog.Errorf("CNI_ASSET_HASH_STRING must look like sha256:<64 hex chars>: %v", err)
    }
    return err
}

When it happens

Trigger: FindCNIAssets is called with CNI_ASSET_HASH_STRING set (and CNI_VERSION_URL set) to a value hashing.FromString rejects, such as a bare hex digest without the "sha256:" prefix, an unknown algorithm, or non-hex characters.

Common situations: User pasted only the raw sha256 digest from a release page without the "sha256:" prefix; used an unsupported algorithm name (md5, sha512) or misspelled one; env var picked up whitespace or quotes from a config file.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unable to parse CNI plugin binaries asset URL %q: %v
• unknown CNI plugin binaries asset: %s
• invalid base channel location: %q
• cannot find subnet %q (declared in instance group %q, not fo
• error parsing configuration: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/afc05697892df206. Report an issue: GitHub.