kubernetes/kops · error

unmarshalling authorization token: %v

Error message

unmarshalling authorization token: %v

What it means

verifyTokenV2 wraps json.Unmarshal failure after base64-decoding a V2 (AWS SDK SigV4a-style) bootstrap token. The payload must be an awsV2Token containing URL, method and signed headers; invalid JSON indicates a corrupt or forged token.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:222

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

func (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %v", err)
	}
	var decoded awsV2Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %v", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	if decoded.SignedHeader.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %v", err)
	}
	signedHeaders := sets.New(strings.Split(reqURL.Query().Get("X-Amz-SignedHeaders"), ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if !a.stsRequestValidator.isValidV2(reqURL) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the token with a compatible kOps version
2. Check for payload corruption in transit
3. Verify token format matches awsV2Token

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:222 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/557ce26c64b49688. Report an issue: GitHub.