kubernetes/kops · error

unexpected credential value

Error message

unexpected credential value

What it means

Companion guard in verifyTokenV1: the parsed authorization must also contain a non-empty Credential element. Missing Credential means the SigV4 header is incomplete (key/region/date scope absent), so caller identity cannot be resolved; the token is rejected before the STS call.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:202

		switch kv[0] {
		case "Signature":
			amzSignature = got
		case "Credential":
			amzCredential = got
		case "SignedHeaders":
			amzSignedHeaders = got
		}
	}
	signedHeaders := sets.New(strings.Split(amzSignedHeaders, ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if amzSignature == "" {
		return nil, fmt.Errorf("unexpected signature value")
	}
	if amzCredential == "" {
		return nil, fmt.Errorf("unexpected credential value")
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

func (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %v", err)
	}
	var decoded awsV2Token

View on GitHub (pinned to 4c8573c808)

Solutions

1. Send the V2 token in standard padded base64
2. Regenerate the bootstrap token
3. Check client kOps version compatibility

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:202 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/edb80a1c185d2bfd. Report an issue: GitHub.