t8y2/dbx · error

service: %w

Error message

service: %w

What it means

This error is returned while parsing a Hadoop delegation token: the fourth length-prefixed byte array (the token service field) could not be read. Identifier, password, and kind parsed fine but the stream ends or is corrupt at the service field, so the token is incomplete.

Source

Thrown at agents/drivers/argo-go/config.go:790

		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))
	identifier, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("identifier: %w", err)
	}
	password, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("password: %w", err)
	}
	if len(identifier) == 0 || len(password) == 0 {
		return nil, nil, errors.New("token identifier and password must be non-empty")
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Re-copy the complete token from its source without line-wrapping changes
2. Regenerate the delegation token from the Hive server
3. Store the token in a single config field/secret, not split across values
4. Validate token integrity (e.g. round-trip base64 decode) before use

Example fix

// before
token := strings.Join(logLines, "") // wrapped log extraction
// after
token := readTokenFromSecretStore()

func tokenEndsWithServiceField(token string) error {
	decoded, err := base64.StdEncoding.DecodeString(token)
	if err != nil { return err }
	if len(decoded) < 48 { return errors.New("token appears truncated before service field") }
	return nil
}

if _, _, err := decodeHadoopDelegationToken(token); err != nil {
	if strings.Contains(err.Error(), "service") {
		return fmt.Errorf("token truncated at service field; fetch a fresh token: %w", err)
	}
	return err
}

When it happens

Trigger: Decoding a delegation token whose payload ends partway through the service field, or whose service length prefix is corrupt.

Common situations: Token cut off near the end by copy/paste or log-line wrapping; token stored across multiple config fields incorrectly.

Related errors

• identifier: %w
• password: %w
• kind: %w
• negative length %d
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/15dcc1c6fa487353. Report an issue: GitHub.