{"record":{"id":"59d8433fc68c32fa","repo":"rancher/rancher","slug":"err-error-59d843","errorCode":null,"errorMessage":"err.Error()","messagePattern":"err\\.Error\\(\\)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/capr/configserver/server.go","lineNumber":130,"sourceCode":"\tif !r.secrets.Informer().HasSynced() || !r.clusterTokens.Informer().HasSynced() {\n\t\tif err := r.secrets.Informer().GetIndexer().Resync(); err != nil {\n\t\t\tlogrus.Errorf(\"error re-syncing secrets informer in rke2configserver: %v\", err)\n\t\t}\n\t\tif err := r.clusterTokens.Informer().GetIndexer().Resync(); err != nil {\n\t\t\tlogrus.Errorf(\"error re-syncing clustertokens informer in rke2configserver: %v\", err)\n\t\t}\n\t\trw.WriteHeader(http.StatusUnauthorized)\n\t\treturn\n\t}\n\tplanSecret, secret, err := r.findSA(req)\n\tif apierrors.IsNotFound(err) {\n\t\trw.WriteHeader(http.StatusUnauthorized)\n\t\treturn\n\t} else if errors.Is(err, errRetrievalInvalidated) {\n\t\trw.WriteHeader(http.StatusUnauthorized)\n\t\treturn\n\t} else if err != nil {\n\t\thttp.Error(rw, err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t} else if secret == nil || secret.Data[corev1.ServiceAccountTokenKey] == nil {\n\t\trw.WriteHeader(http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\tswitch req.URL.Path {\n\tcase ConnectConfigYamlPath:\n\t\tr.connectConfigYaml(planSecret, secret.Namespace, rw)\n\tcase ConnectAgent:\n\t\tr.connectAgent(planSecret, secret, rw, req)\n\tcase ConnectClusterInfo:\n\t\tr.connectClusterInfo(secret, rw, req)\n\t}\n}\n\nfunc (r *RKE2ConfigServer) connectAgent(planSecret string, secret *corev1.Secret, rw http.ResponseWriter, req *http.Request) {\n\tvar ca []byte","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/capr/configserver/server.go#L112-L148","documentation":"ServeHTTP resolves the caller's service account and its machine plan secret via findSA before dispatching to any connect endpoint. NotFound and errRetrievalInvalidated are deliberately mapped to 401 (unknown or invalidated token); this 500 is reserved for any other findSA error - informer cache failures, apiserver errors, or unexpected lookup results. The raw error text is sent to the node client.","triggerScenarios":"system-agent presents a bearer token while the apiserver call behind the token/secret lookup fails with a timeout or throttle, or the backing informer caches return an error mid-provisioning.","commonSituations":"apiserver pressure during scale-up of many nodes; rancher restart while tokens are being rotated; a race where the service account is deleted between validation and plan-secret lookup.","solutions":["Retry the connect request after a few seconds - most backing errors are transient.","Check rancher logs for the findSA error preceding this response.","Verify the plan secret and its service account still exist in the cluster's namespace.","Confirm rancher and the apiserver are not under sustained throttling (429s in logs)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"curl -s -o /dev/null -w '%{http_code}' -H \"Authorization: Bearer $T\" https://rancher/v-connect/agent # 401=token problem (fix auth), 500=backing store (retry)","typeGuard":null,"tryCatchPattern":"for i := 0; i < N; i++ {\n    resp, err := client.Do(req)\n    if err == nil && resp.StatusCode == http.StatusOK { break }\n    if resp != nil && resp.StatusCode == http.StatusUnauthorized { return fmt.Errorf(\"token rejected - do not retry\") }\n    time.Sleep(backoff(i))\n}","preventionTips":["Distinguish 401 (permanent, fix credentials) from 500 (transient, retry) on connect endpoints.","Keep the apiserver healthy during mass scale-ups; throttle node enrollment bursts.","Let system-agent handle retries rather than scripting one-shot connect calls."],"tags":["rancher","system-agent","provisioning","kubernetes","http"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}