kubernetes/kops · error

unexpected signature value

Error message

unexpected signature value

What it means

verifyTokenV1 parses the SigV4 Authorization components (Signature, Credential, SignedHeaders); after confirming x-kops-request-sha is among the signed headers, it requires a non-empty Signature. This error means the token's authorization header lacked the Signature element, so the request cannot be verified against STS.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:199

			return nil, fmt.Errorf("incorrect authorization format")
		}
		got := kv[1]
		switch kv[0] {
		case "Signature":
			amzSignature = got
		case "Credential":
			amzCredential = got
		case "SignedHeaders":
			amzSignedHeaders = got
		}
	}
	signedHeaders := sets.New(strings.Split(amzSignedHeaders, ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if amzSignature == "" {
		return nil, fmt.Errorf("unexpected signature value")
	}
	if amzCredential == "" {
		return nil, fmt.Errorf("unexpected credential value")
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

func (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the presigned STS URL with a signature
2. Check token truncation in transit
3. Use matching kOps versions

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:199 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c99f244d3b24f50. Report an issue: GitHub.