kubernetes/kops · error

unable to verify token

Error message

unable to verify token

What it means

VerifyToken iterates all registered Verifiers and, when every one fails to validate the bearer token, returns this generic sentinel error. The per-verifier causes are logged via klog.Infof ('failed to verify token') but are not included in the returned error, so callers only see the aggregate failure. It means no bootstrap verifier accepted the token (e.g. no AWS verifier for an AWS-signed request, or STS validation failed).

Source

Thrown at pkg/bootstrap/chain.go:52

	chain []Verifier
}

// VerifyToken will return the first positive verification from any Verifier in the chain.
func (v *ChainVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*VerifyResult, error) {
	for _, verifier := range v.chain {
		result, err := verifier.VerifyToken(ctx, rawRequest, token, body)
		if err == nil {
			return result, nil
		}
		if err == ErrNotThisVerifier {
			continue
		}
		if err == ErrAlreadyExists {
			return nil, ErrAlreadyExists
		}
		klog.Infof("failed to verify token: %v", err)
	}
	return nil, fmt.Errorf("unable to verify token")
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the klog server logs for the preceding 'failed to verify token: %v' line to find the real per-verifier cause
2. Confirm the correct verifier (e.g. AWS verifier) is registered for the cluster's cloud in the bootstrap server setup
3. Verify the node is targeting the correct cluster name and API endpoint
4. Check system clock skew on nodes and server, which breaks presigned STS URLs

resp, err := client.VerifyToken(ctx, req)
if err != nil {
  if errors.Is(err, bootstrap.ErrAlreadyExists) { /* already registered */ }
  klog.Errorf("bootstrap token rejected: %v — check server klog for per-verifier cause", err)
  return err
}

When it happens

Trigger: A node sends a bootstrap request with a token that every configured verifier rejects: wrong cluster for the verifier, the AWS verifier is not registered for this cloud, expired/invalid presigned STS token, or token signed for a different cluster name.

Common situations: Node bootstrapping against the wrong API server/cluster; kops server missing the cloud-specific verifier registration; clock skew invalidating presigned URLs; node using a token format from a different kops version.

Related errors

• node identity is required
• did not find owner for node %q
• error building InstanceGroup from CAPI Machine: %w
• error loading NodeupConfig %q: %v
• invalid authorization token

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9afa41b847d3da36. Report an issue: GitHub.