{"record":{"id":"7cbcfcd7d6832ca9","repo":"kubernetes/kops","slug":"converting-kubeconfig-to-yaml-w","errorCode":null,"errorMessage":"converting kubeconfig to yaml: %w","messagePattern":"converting kubeconfig to yaml: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/controllers/clusterapi/cluster_controller.go","lineNumber":288,"sourceCode":"\t\t\t\t\t\"name\": \"in-cluster\",\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"current-context\": \"in-cluster\",\n\t\t\t\"kind\":            \"Config\",\n\t\t\t\"preferences\":     map[string]any{},\n\t\t\t\"users\": []map[string]any{\n\t\t\t\t{\n\t\t\t\t\t\"name\": \"in-cluster\",\n\t\t\t\t\t\"user\": map[string]any{ //nolint:gosec // This is a kubeconfig field name, not a credential.\n\t\t\t\t\t\t\"tokenFile\": \"/var/run/secrets/kubernetes.io/serviceaccount/token\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\n\t\tkubeconfigBytes, err := yaml.Marshal(kubeconfig)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"converting kubeconfig to yaml: %w\", err)\n\t\t}\n\n\t\tobj := map[string]any{\n\t\t\t\"apiVersion\": \"v1\",\n\t\t\t\"kind\":       \"Secret\",\n\t\t\t\"metadata\": map[string]any{\n\t\t\t\t\"name\":      name + \"-kubeconfig\",\n\t\t\t\t\"namespace\": s.namespace(),\n\t\t\t},\n\t\t\t\"data\": map[string]any{\n\t\t\t\t\"value\": kubeconfigBytes,\n\t\t\t},\n\t\t\t\"type\": \"Opaque\",\n\t\t}\n\n\t\tu := &unstructured.Unstructured{Object: obj}\n\n\t\t// Needed so that capi manager has \"permission\" to read the secret","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/controllers/clusterapi/cluster_controller.go#L270-L306","documentation":"createKopsControlPlane builds an in-cluster kubeconfig (map[string]any) and serializes it to YAML before embedding it in an Opaque Secret. This error wraps a yaml.Marshal failure. Since the input is a plain map of YAML-safe values, this is practically unreachable except for types that cannot be marshaled or data containing values that sigs.k8s.io/yaml cannot convert to JSON.","triggerScenarios":"yaml.Marshal on the kubeconfig map fails — essentially only if a value in the map is not JSON-marshalable (e.g. a func, channel, or circular structure) or the marshal operation fails at the JSON round-trip level used by sigs.k8s.io/yaml.","commonSituations":"A code change introduces a non-marshalable value into the kubeconfig map (custom type, unexported/unsupported field); extremely rare at runtime for users of the library.","solutions":["Inspect the wrapped %w error to identify the non-marshalable value","Ensure all kubeconfig map values are JSON/YAML-safe basic types (string, []map[string]any)","Update kops / sigs.k8s.io/yaml to a version with relevant marshal fixes if a library bug is suspected"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"kubeconfigBytes, err := yaml.Marshal(kubeconfig)\nif err != nil {\n    return fmt.Errorf(\"converting kubeconfig to yaml: %w\", err)\n}","preventionTips":["Keep kubeconfig map values restricted to JSON/YAML-safe basic types","Add a unit test marshaling the assembled kubeconfig map","Pin compatible versions of sigs.k8s.io/yaml"],"tags":["yaml","kubeconfig","serialization"],"backgroundTag":"yaml-marshal-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}