{"record":{"id":"fde25e8cdc35ed25","repo":"ahmetb/kubectx","slug":"failed-to-parse-kubeconfig-w","errorCode":null,"errorMessage":"failed to parse kubeconfig: %w","messagePattern":"failed to parse kubeconfig: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/proxy/kubeconfig.go","lineNumber":19,"sourceCode":"package proxy\n\nimport (\n\t\"fmt\"\n\n\t\"k8s.io/client-go/tools/clientcmd\"\n\tclientcmdapi \"k8s.io/client-go/tools/clientcmd/api\"\n)\n\n// RewriteKubeconfig takes minified kubeconfig bytes and rewrites them so that:\n//   - The cluster server URL points to the local proxy address (plain HTTP).\n//   - insecure-skip-tls-verify is set (needed for plain HTTP).\n//   - Certificate authority data is removed.\n//   - User auth fields (client certs, tokens, exec, auth-provider) are removed\n//     since the proxy handles authentication to the real API server.\nfunc RewriteKubeconfig(data []byte, proxyAddr string) ([]byte, error) {\n\tcfg, err := clientcmd.Load(data)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse kubeconfig: %w\", err)\n\t}\n\n\tfor _, cluster := range cfg.Clusters {\n\t\tcluster.Server = \"http://\" + proxyAddr\n\t\tcluster.InsecureSkipTLSVerify = true\n\t\tcluster.CertificateAuthority = \"\"\n\t\tcluster.CertificateAuthorityData = nil\n\t}\n\n\tfor name := range cfg.AuthInfos {\n\t\tcfg.AuthInfos[name] = &clientcmdapi.AuthInfo{}\n\t}\n\n\t// Rename contexts with [RO] suffix to indicate readonly mode.\n\trenames := make(map[string]string, len(cfg.Contexts))\n\tfor name := range cfg.Contexts {\n\t\trenames[name] = name + \"[RO]\"\n\t}","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/ahmetb/kubectx/blob/12ad6fb22e8c546ee2b54e7de38aa51c906832f7/internal/proxy/kubeconfig.go#L1-L37","documentation":"proxy.RewriteKubeconfig parses the input kubeconfig YAML bytes with client-go's clientcmd.Load before rewriting cluster/server entries. This error wraps any clientcmd parse/validation failure, including malformed YAML and kubeconfig data that fails clientcmd's structural validation (missing required fields).","triggerScenarios":"Calling RewriteKubeconfig with data that is not valid kubeconfig YAML/JSON, is empty, has wrong indentation, contains tabs, or lacks required fields (e.g. cluster without a server, context without cluster/user references).","commonSituations":"Reading a kubeconfig that was truncated or hand-edited; passing a regular kubeconfig of a different format (e.g. merged multi-doc file); passing an exec-credential JSON blob instead of a kubeconfig; encoding mix-ups (passing the wrong file's bytes).","solutions":["Validate the input independently first: kubectl --kubeconfig <file> config view (or clientcmd.Load in a scratch program) to see the parse error","Fix YAML syntax errors (tabs vs spaces, indentation) reported in the wrapped error","Ensure the bytes are a complete kubeconfig with apiVersion: v1, kind: Config and valid clusters/contexts/users sections","Confirm the source of the bytes (file path, HTTP response) actually contains the kubeconfig and not an error page or partial read"],"exampleFix":"// before\ndata, _ := execOut := os.ReadFile(\"cred.json\")\nproxy.RewriteKubeconfig(data, addr) // not a kubeconfig\n// after\ndata, err := os.ReadFile(\"config\")\nif err != nil { return err }\nout, err := proxy.RewriteKubeconfig(data, addr)","handlingStrategy":"validation","validationCode":"// Go\n// Pre-validate the input bytes before RewriteKubeconfig\ncfg, err := clientcmd.Load(data)\nif err != nil {\n    return fmt.Errorf(\"input is not a valid kubeconfig: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"out, err := proxy.RewriteKubeconfig(data, addr)\nif err != nil {\n    var uerr *url.Error\n    if strings.Contains(err.Error(), \"failed to parse kubeconfig\") {\n        return fmt.Errorf(\"check YAML syntax and required fields: %w\", err)\n    }\n    return err\n}","preventionTips":["Never hand-edit kubeconfigs with tabs; validate YAML before use","Verify file bytes with `kubectl --kubeconfig <file> config view` before feeding them to tooling","Ensure reads are complete (check io.EOF / read return values)","Keep apiVersion: v1, kind: Config and at least one valid cluster/context"],"tags":["kubeconfig","yaml","client-go","validation","go"],"backgroundTag":"kubeconfig-parse-failed","analyzedSha":"12ad6fb22e8c546ee2b54e7de38aa51c906832f7","analyzedAt":"2026-09-02T12:23:10.107Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T16:17:10.729Z"}