kubernetes/kops · error

unmarshalling authorization token: %w

Error message

unmarshalling authorization token: %w

What it means

The base64-decoded token bytes are not a JSON AuthToken object: the token decoded but does not match the expected schema, e.g. a token produced by an incompatible token version or corrupted between issuance and verification.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:79

}

var _ bootstrap.Verifier = &verifier{}

// TODO: Dedup with gce
func (v *verifier) parseTokenData(tokenPrefix string, authToken string, body []byte) (*pkibootstrap.AuthToken, *pkibootstrap.AuthTokenData, error) {
	if !strings.HasPrefix(authToken, tokenPrefix) {
		return nil, nil, bootstrap.ErrNotThisVerifier
	}
	authToken = strings.TrimPrefix(authToken, tokenPrefix)

	tokenBytes, err := base64.StdEncoding.DecodeString(authToken)
	if err != nil {
		return nil, nil, fmt.Errorf("decoding authorization token: %w", err)
	}

	token := &pkibootstrap.AuthToken{}
	if err = json.Unmarshal(tokenBytes, token); err != nil {
		return nil, nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	tokenData := &pkibootstrap.AuthTokenData{}
	if err := json.Unmarshal(token.Data, tokenData); err != nil {
		return nil, nil, fmt.Errorf("unmarshalling authorization token data: %w", err)
	}

	// Guard against replay attacks
	if tokenData.Audience != pkibootstrap.AudienceNodeAuthentication {
		return nil, nil, fmt.Errorf("incorrect Audience")
	}
	timeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())
	if timeSkew > float64(v.opt.MaxTimeSkew) {
		return nil, nil, fmt.Errorf("incorrect Timestamp %v", tokenData.Timestamp)
	}

	// Verify the token has signed the body content.
	requestHash := sha256.Sum256(body)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify client and verifier run compatible token versions
2. Confirm the token was produced by the matching CreateToken implementation
3. Regenerate the token on the node and retry verification

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/59e458306ced954f. Report an issue: GitHub.