kubernetes/kops · error

unmarshalling authorization token: %w

Error message

unmarshalling authorization token: %w

What it means

verifyTokenV1 wraps json.Unmarshal failure after base64-decoding the kops bootstrap authentication token. The decoded token payload is expected to be an awsV1Token (HTTP headers map); malformed JSON means the client-side token was generated by an incompatible or tampered source.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:158

		return a.verifyTokenV1(ctx, token, body, a.verifyCallerIdentity)
	}
	if strings.HasPrefix(token, AWSAuthenticationTokenPrefixV2) {
		return a.verifyTokenV2(ctx, token, body, a.verifyCallerIdentity)
	}

	return nil, bootstrap.ErrNotThisVerifier
}

func (a awsVerifier) verifyTokenV1(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {
	token = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV1)

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %w", err)
	}
	var decoded awsV1Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	decodedHeaders := http.Header(decoded)

	if decodedHeaders.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	authorization := decodedHeaders.Get("Authorization")
	if !strings.HasPrefix(authorization, "AWS4-HMAC-SHA256 ") {
		return nil, fmt.Errorf("incorrect authorization algorithm")
	}

	amzSignature := ""
	amzCredential := ""
	amzSignedHeaders := ""

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the token was produced by a matching kOps version
2. Re-generate the bootstrap token
3. Check for proxies modifying the token payload

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/98e9fc575b7629dd. Report an issue: GitHub.