{"record":{"id":"5041c35d5e1bf44f","repo":"kubernetes/kops","slug":"encoding-ecr-credential-provider-config-w","errorCode":null,"errorMessage":"encoding ECR credential provider config: %w","messagePattern":"encoding ECR credential provider config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/kubelet.go","lineNumber":680,"sourceCode":"\t\tproviderConfig.Providers = []kubeletv1.CredentialProvider{\n\t\t\t{\n\t\t\t\tAPIVersion:           \"credentialprovider.kubelet.k8s.io/v1\",\n\t\t\t\tName:                 \"ecr-credential-provider\",\n\t\t\t\tMatchImages:          registryList,\n\t\t\t\tDefaultCacheDuration: &metav1.Duration{Duration: cacheDuration},\n\t\t\t\tArgs:                 []string{\"get-credentials\"},\n\t\t\t\tEnv: []kubeletv1.ExecEnvVar{\n\t\t\t\t\t{\n\t\t\t\t\t\tName:  \"AWS_REGION\",\n\t\t\t\t\t\tValue: b.Cloud.Region(),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\n\t\tvar buf bytes.Buffer\n\t\tif err := kubeletV1Encoder.Encode(providerConfig, &buf); err != nil {\n\t\t\treturn fmt.Errorf(\"encoding ECR credential provider config: %w\", err)\n\t\t}\n\n\t\tc.AddTask(&nodetasks.File{\n\t\t\tPath:     credentialProviderConfigFilePath,\n\t\t\tContents: fi.NewBytesResource(buf.Bytes()),\n\t\t\tType:     nodetasks.FileType_File,\n\t\t\tMode:     s(\"0644\"),\n\t\t})\n\t}\n\treturn nil\n}\n\n// addGCPCredentialProvider installs the GCP Kubelet Credential Provider\nfunc (b *KubeletBuilder) addGCPCredentialProvider(c *fi.NodeupModelBuilderContext) error {\n\t{\n\t\tassetName := \"auth-provider-gcp\"\n\t\tassetPath := \"\"\n\t\tasset, err := b.Assets.Find(assetName, assetPath)","sourceCodeStart":662,"sourceCodeEnd":698,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/kubelet.go#L662-L698","documentation":"addECRCredentialProvider serializes the generated ECR credential provider kubelet config (api.CredentialProviderConfig) to YAML using kubeletV1Encoder. An encoder failure is wrapped as \"encoding ECR credential provider config: %w\". This is rare since the config is a simple static struct.","triggerScenarios":"kubeletV1Encoder.Encode(providerConfig, &buf) returns an error while marshaling the CredentialProviderConfig containing the ecr-credential-provider entry — e.g. a marshaling bug, interface conversion problem, or an unsupported field introduced by a code change.","commonSituations":"Encountered during kOps development/forks after modifying the provider config struct; essentially never seen from user configuration because the config is constructed in code.","solutions":["Read the wrapped inner error to identify which field fails to marshal.","Rebuild nodeup from the matching kOps version; report a kOps bug if it reproduces on unmodified code.","Verify the kubelet API types vendored in the build match the intended k8s version (kubeletV1Encoder)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"var buf bytes.Buffer\nif err := kubeletV1Encoder.Encode(providerConfig, &buf); err != nil {\n\treturn fmt.Errorf(\"encoding ECR credential provider config: %w\", err)\n}\n// caller: treat as unrecoverable build error; capture the wrapped cause for a bug report\nif strings.Contains(err.Error(), \"encoding ECR credential provider config\") {\n\tklog.Errorf(\"ECR provider config marshal failed: %v\", errors.Unwrap(err))\n}","preventionTips":["Keep vendored k8s kubelet API types in sync with the kOps version","Run nodeup unit tests after modifying provider config structs","Report upstream: this indicates a code defect, not user misconfiguration"],"tags":["nodeup","aws","ecr","yaml-encoding"],"backgroundTag":"config-serialization-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}