{"record":{"id":"a3876acd92c522f6","repo":"kubernetes/kops","slug":"failed-to-sign-token-data-w","errorCode":null,"errorMessage":"failed to sign token data: %w","messagePattern":"failed to sign token data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkisigner.go","lineNumber":123,"sourceCode":"\trequestHash := sha256.Sum256(body)\n\n\tdata := AuthTokenData{\n\t\tTimestamp:   time.Now().Unix(),\n\t\tAudience:    AudienceNodeAuthentication,\n\t\tRequestHash: requestHash[:],\n\n\t\tKeyID:    a.keyID,\n\t\tInstance: a.hostname,\n\t}\n\n\tpayload, err := json.Marshal(&data)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to marshal token data: %w\", err)\n\t}\n\n\tsignature, err := a.sign(payload)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to sign token data: %w\", err)\n\t}\n\ttoken := &AuthToken{\n\t\tData:      payload,\n\t\tSignature: signature,\n\t}\n\n\tb, err := json.Marshal(token)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to marshal token: %w\", err)\n\t}\n\treturn AuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil\n}\n\n// sign performs a TPM signature with the tpmKey, and sanity checks the result.\nfunc (a *pkiAuthenticator) sign(payload []byte) ([]byte, error) {\n\tbeforeSign := time.Now()\n\n\tdigest := sha256.Sum256(payload)","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkisigner.go#L105-L141","documentation":"The crypto.Signer refused to sign the marshaled token payload: a TPM- or KMS-backed signer failed the operation (TPM session lost, key handle invalidated, entropy source exhausted) after the payload was successfully built.","triggerScenarios":"Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["For TPM signers, verify the TPM is present and the key handle is still loaded (tpm2 tools)","Restart the node/bootstrap agent to re-establish the signer session","Inspect the wrapped error for the underlying provider status"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}