kubernetes/kops · error

unmarshalling attested data: %w

Error message

unmarshalling attested data: %w

What it means

The signed PKCS7 content (the attested document JSON) could not be unmarshalled into attestedData, meaning the Azure-signed payload does not match the expected schema. Indicates an unexpected or tampered document format.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:280

		return nil, nil, fmt.Errorf("validating PKCS7 signer SAN: %w", err)
	}
	klog.V(4).Infof("PKCS7 signer SAN validated as Azure metadata endpoint")

	return p7, signer, nil
}

// nonceForBody derives the IMDS attestation nonce from the request body; the shared
// azuremetadata implementation keeps the authenticator and verifier sides identical.
func nonceForBody(body []byte) string {
	return azuremetadata.NonceForBody(body)
}

// parseAndValidateAttestedDocumentContent unmarshals the signed attestation payload and validates
// its nonce and freshness timestamps.
func parseAndValidateAttestedDocumentContent(content []byte, body []byte) (*attestedData, error) {
	var data attestedData
	if err := json.Unmarshal(content, &data); err != nil {
		return nil, fmt.Errorf("unmarshalling attested data: %w", err)
	}
	klog.V(4).Infof("Attested document content: vmId=%q subscriptionId=%q createdOn=%q expiresOn=%q", data.VMId, data.SubscriptionId, data.TimeStamp.CreatedOn, data.TimeStamp.ExpiresOn)

	if data.VMId == "" {
		return nil, fmt.Errorf("attested document vmId is required")
	}
	if data.SubscriptionId == "" {
		return nil, fmt.Errorf("attested document subscriptionId is required")
	}

	// Verify the nonce matches the request body hash (replay protection).
	expectedNonce := nonceForBody(body)
	if data.Nonce != expectedNonce {
		return nil, fmt.Errorf("attested document nonce mismatch: got=%q expected=%q", data.Nonce, expectedNonce)
	}

	now := time.Now().UTC()
	if data.TimeStamp.CreatedOn == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reject the attestation
2. Update kOps if Azure changed the attested document schema
3. Verify the IMDS endpoint is genuine Azure IMDS (169.254.169.254)

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/attest.go:280 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e6f3e8f736a1bdd1. Report an issue: GitHub.