{"record":{"id":"4ddc90e2786ba0dd","repo":"rancher/rancher","slug":"timeout-waiting-for-plan","errorCode":null,"errorMessage":"timeout waiting for plan","messagePattern":"timeout waiting for plan","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/capr/configserver/server.go","lineNumber":472,"sourceCode":"\t})\n\tif err != nil {\n\t\treturn \"\", nil, err\n\t}\n\tdefer func() {\n\t\trespSecret.Stop()\n\t\t//nolint:revive\n\t\tfor range respSecret.ResultChan() {\n\t\t\t// Intentionally drain the channel.\n\t\t}\n\t}()\n\tfor event := range respSecret.ResultChan() {\n\t\tif secret, ok := event.Object.(*corev1.Secret); ok {\n\t\t\tlogrus.Infof(\"[rke2configserver] %s/%s machineID: %s delivering planSecret %s with token secret %s/%s to system-agent from secret watch\", ref.Namespace, ref.Name, machineID, planSecret, secret.Namespace, secret.Name)\n\t\t\treturn planSecret, secret, nil\n\t\t}\n\t}\n\n\treturn \"\", nil, fmt.Errorf(\"timeout waiting for plan\")\n}\n\nfunc (r *RKE2ConfigServer) setOrUpdateMachineID(ref *corev1.ObjectReference, machineID string) error {\n\tif ref == nil {\n\t\treturn nil\n\t}\n\n\t// Only update CAPI Machines; no-op for other kinds (e.g., management Nodes).\n\tif ref.APIVersion != capi.GroupVersion.String() || ref.Kind != \"Machine\" {\n\t\treturn nil\n\t}\n\n\tmachineNamespace, machineName := ref.Namespace, ref.Name\n\n\tmachine, err := r.machineCache.Get(machineNamespace, machineName)\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":454,"sourceCodeEnd":490,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/capr/configserver/server.go#L454-L490","documentation":"The final stage of findSA watches Secrets labeled for the discovered plan service account, waiting for the serviceaccounttoken controller to publish a token. Despite the name, there is no explicit timer: this error is returned when the secret watch channel closes without delivering a single Secret event. The node's system-agent treats it as retryable and re-issues the HTTP request on its next polling cycle.","triggerScenarios":"kube-controller-manager has not generated a token secret for the plan SA within the watch window; the token secret is created without the expected serviceaccounttoken label (version skew); the watch is closed by the API server before any event arrives.","commonSituations":"Overloaded management cluster slowing token issuance; Kubernetes version changes to service-account token behavior; admission policies blocking token secret creation; watches timing out behind proxies with short idle limits.","solutions":["Retry: system-agent polls again and controllers usually catch up, resolving the condition on a later request","Verify token issuance works: kubectl get secrets -n <ns> -l kubernetes.io/service-account.name=<plan-sa-name>","Check kube-controller-manager health and logs on the management cluster","If behind an ingress/proxy, raise idle timeouts so config-server watches are not cut off early"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep kube-controller-manager healthy and sized for the management cluster's load","Avoid admission policies that block service-account token secret creation","Raise proxy/ingress idle timeouts in front of Rancher so watches are not cut short","Alert on repeated 'timeout waiting for plan' from the config server, not single occurrences"],"tags":["watch","service-account","token","timeout","configserver"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}