{"record":{"id":"a816fd14a7e82da1","repo":"kubernetes/kops","slug":"converting-token-to-json-w","errorCode":null,"errorMessage":"converting token to json: %w","messagePattern":"converting token to json: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":172,"sourceCode":"\n\t// Ensure the signature is only valid for this particular body content.\n\tstsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}, func(po *sts.PresignOptions) {\n\t\tpo.ClientOptions = append(po.ClientOptions, func(o *sts.Options) {\n\t\t\to.APIOptions = append(o.APIOptions, smithyhttp.AddHeaderValue(\"X-Kops-Request-SHA\", base64.RawStdEncoding.EncodeToString(sha[:])))\n\t\t})\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building AWS STS presigned request: %w\", err)\n\t}\n\n\tawsV2Token := &awsV2Token{\n\t\tURL:          stsRequest.URL,\n\t\tMethod:       stsRequest.Method,\n\t\tSignedHeader: stsRequest.SignedHeader,\n\t}\n\ttoken, err := json.Marshal(awsV2Token)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"converting token to json: %w\", err)\n\t}\n\n\treturn AWSAuthenticationTokenPrefixV2 + base64.StdEncoding.EncodeToString(token), nil\n}\n\nfunc signV1Request(ctx context.Context, stsURL string, region string, credentials aws.Credentials, signingTime time.Time, kopsRequestBody []byte) (*http.Request, error) {\n\tkopsRequestHash := sha256.Sum256(kopsRequestBody)\n\tkopsRequestHashBase64 := base64.RawStdEncoding.EncodeToString(kopsRequestHash[:])\n\n\t// V1 requests use a well-known body (and host)\n\tbody := []byte(\"Action=GetCallerIdentity&Version=2011-06-15\")\n\n\tbodyHash := sha256.Sum256(body)\n\n\tsignedRequest, err := http.NewRequest(\"POST\", stsURL, bytes.NewReader(body))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"building http request: %v\", err)\n\t}","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L154-L190","documentation":"createTokenV2 wraps an error from json.Marshal(awsV2Token) when serializing the presigned request (URL, method, signed headers) into JSON for base64 embedding in the token. The awsV2Token struct contains only strings and string maps, so this marshal cannot realistically fail; it is a defensive branch.","triggerScenarios":"json.Marshal of the awsV2Token struct fails in createTokenV2 (CreateToken v2 path) — practically unreachable unless SignedHeader contains unsupported types, which the SDK types prevent.","commonSituations":"Effectively never; only conceivable in patched/vendored builds where awsV2Token gained an unmarshalable field.","solutions":["Retry CreateToken — treat as transient/environmental if ever observed.","Verify no local patches to awsV2Token; revert to upstream kOps code.","File a kOps bug with the wrapped error if reproducible."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"token, err := auth.CreateToken(body)\nif err != nil {\n\tlog.Errorf(\"CreateToken(v2) failed: %v\", err) // defensive branch; log and report\n}","preventionTips":["Do not add unmarshalable fields to awsV2Token.","Report reproducible failures upstream to kOps."],"tags":["json","serialization","defensive","bootstrap"],"backgroundTag":"json-marshal-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}