kubernetes/kops · info

converting headers to json: %w

Error message

converting headers to json: %w

What it means

createTokenV1 wraps an error from json.Marshal(req.Header) — converting the signed http.Header map into JSON before base64-encoding it into the token. http.Header is always JSON-marshalable (map[string][]string), so this error is practically unreachable and would indicate a non-standard Header type or corrupted request.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:131

	credentials, err := a.credentialsProvider.Retrieve(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS credentials: %w", err)
	}

	host, err := a.getSTSHost(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS STS url: %w", err)
	}
	stsURL := "https://" + host + "/"
	region := a.region

	req, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)
	if err != nil {
		return "", fmt.Errorf("building (v1) signed request: %w", err)
	}
	headers, err := json.Marshal(req.Header)
	if err != nil {
		return "", fmt.Errorf("converting headers to json: %w", err)
	}
	return AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil
}

func (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {
	// An inefficient but reliable way to get the STS url
	presignClient := sts.NewPresignClient(a.sts)
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
	if err != nil {
		return "", fmt.Errorf("building AWS STS presigned request: %w", err)
	}
	u, err := url.Parse(stsRequest.URL)
	if err != nil {
		return "", fmt.Errorf("parsing AWS STS url: %w", err)
	}
	return u.Host, err
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Treat as a defensive branch: if hit, re-run CreateToken; the failure is transient or environmental.
2. Inspect the wrapped error message; if persistent, verify you are running unmodified kOps code (no vendored patch to signV1Request).
3. Report a bug to kOps with the wrapped error text if it reproduces.

token, err := auth.CreateToken(body)
if err != nil {
	log.Errorf("CreateToken failed: %v", err) // unreachable branch; log and report
}

When it happens

Trigger: json.Marshal(req.Header) fails in createTokenV1 after successful signing — only if req.Header contains a type that cannot serialize, which cannot happen with a standard http.Request built by signV1Request.

Common situations: Effectively never in production; theoretically only if signV1Request were replaced or tests injected a custom Header implementation.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• converting token to json: %w
• error encoding version spec: %v
• error building annotation patch: %v
• building node patch: %w
• error building node patch: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3bdffdb9cf9b38b6. Report an issue: GitHub.