t8y2/dbx · error

token is empty

Error message

token is empty

What it means

decodeHadoopDelegationToken parses a Hadoop delegation token: it joins/trimmes whitespace and requires a non-empty base64 payload before decoding. If the encoded input is empty after normalization, it returns this error, which the caller wraps as 'decode Hive delegation token: token is empty'.

Source

Thrown at agents/drivers/argo-go/config.go:756

	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error
	for _, encoding := range []*base64.Encoding{
		base64.RawURLEncoding,
		base64.URLEncoding,
		base64.RawStdEncoding,
		base64.StdEncoding,
	} {
		decoded, decodeErr = encoding.DecodeString(encoded)
		if decodeErr == nil {
			break
		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))

View on GitHub (pinned to c0390bff16)

Solutions

1. Provide a real base64-encoded Hadoop delegation token string
2. Trim-check the token source (env var, file, secret) to confirm it is non-empty
3. Fix upstream secret injection — an empty secret often means the secret was never mounted/created

Example fix

// before
values["delegationToken"] = os.Getenv("HIVE_TOKEN") // may be ""
// after
tok := strings.TrimSpace(os.Getenv("HIVE_TOKEN"))
if tok == "" { return fmt.Errorf("HIVE_TOKEN is not set") }
values["delegationToken"] = tok

if strings.TrimSpace(tokenStr) == "" {
    return errors.New("delegation token is empty; check token source")
}

identifier, password, err := decodeHadoopDelegationToken(token)
if err != nil {
    return fmt.Errorf("delegation token unusable: %w", err)
}

When it happens

Trigger: Calling decodeHadoopDelegationToken (via applyDelegationToken) with a token string that is empty or only whitespace after strings.Fields/TrimSpace normalization.

Common situations: A parameter like token=" " or delegationToken="" passing the firstNonEmpty check despite being whitespace-only; an env var set to an empty string; a token accidentally stripped during templating/YAML interpolation.

Related errors

• Hive connection string must start with jdbc:hive2:// or hive
• Hive delegation token authentication requires delegationToke
• token identifier and password must be non-empty
• token is empty
• table is required

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/8e364dedb092bf7d. Report an issue: GitHub.