kubernetes/kops · error

unexpected signed headers value

Error message

unexpected signed headers value

What it means

Verification guard in verifyTokenV1: the SignedHeaders list of the presigned request does not include x-kops-request-sha, so the request body hash is not covered by the signature and the token is rejected.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:195

	for _, token := range strings.Split(strings.TrimPrefix(authorization, "AWS4-HMAC-SHA256 "), ", ") {
		kv := strings.SplitN(token, "=", 2)
		if len(kv) == 1 {
			return nil, fmt.Errorf("incorrect authorization format")
		}
		got := kv[1]
		switch kv[0] {
		case "Signature":
			amzSignature = got
		case "Credential":
			amzCredential = got
		case "SignedHeaders":
			amzSignedHeaders = got
		}
	}
	signedHeaders := sets.New(strings.Split(amzSignedHeaders, ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if amzSignature == "" {
		return nil, fmt.Errorf("unexpected signature value")
	}
	if amzCredential == "" {
		return nil, fmt.Errorf("unexpected credential value")
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

func (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Sign x-kops-request-sha when generating the token
2. Use kOps' own token generation code
3. Update mismatched kOps client versions

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:195 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9f3d5088516c120d. Report an issue: GitHub.