kubernetes/kops · info

converting token to json: %w

Error message

converting token to json: %w

What it means

createTokenV2 wraps an error from json.Marshal(awsV2Token) when serializing the presigned request (URL, method, signed headers) into JSON for base64 embedding in the token. The awsV2Token struct contains only strings and string maps, so this marshal cannot realistically fail; it is a defensive branch.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:172

	// Ensure the signature is only valid for this particular body content.
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}, func(po *sts.PresignOptions) {
		po.ClientOptions = append(po.ClientOptions, func(o *sts.Options) {
			o.APIOptions = append(o.APIOptions, smithyhttp.AddHeaderValue("X-Kops-Request-SHA", base64.RawStdEncoding.EncodeToString(sha[:])))
		})
	})
	if err != nil {
		return "", fmt.Errorf("building AWS STS presigned request: %w", err)
	}

	awsV2Token := &awsV2Token{
		URL:          stsRequest.URL,
		Method:       stsRequest.Method,
		SignedHeader: stsRequest.SignedHeader,
	}
	token, err := json.Marshal(awsV2Token)
	if err != nil {
		return "", fmt.Errorf("converting token to json: %w", err)
	}

	return AWSAuthenticationTokenPrefixV2 + base64.StdEncoding.EncodeToString(token), nil
}

func signV1Request(ctx context.Context, stsURL string, region string, credentials aws.Credentials, signingTime time.Time, kopsRequestBody []byte) (*http.Request, error) {
	kopsRequestHash := sha256.Sum256(kopsRequestBody)
	kopsRequestHashBase64 := base64.RawStdEncoding.EncodeToString(kopsRequestHash[:])

	// V1 requests use a well-known body (and host)
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	bodyHash := sha256.Sum256(body)

	signedRequest, err := http.NewRequest("POST", stsURL, bytes.NewReader(body))
	if err != nil {
		return nil, fmt.Errorf("building http request: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry CreateToken — treat as transient/environmental if ever observed.
2. Verify no local patches to awsV2Token; revert to upstream kOps code.
3. File a kOps bug with the wrapped error if reproducible.

token, err := auth.CreateToken(body)
if err != nil {
	log.Errorf("CreateToken(v2) failed: %v", err) // defensive branch; log and report
}

When it happens

Trigger: json.Marshal of the awsV2Token struct fails in createTokenV2 (CreateToken v2 path) — practically unreachable unless SignedHeader contains unsupported types, which the SDK types prevent.

Common situations: Effectively never; only conceivable in patched/vendored builds where awsV2Token gained an unmarshalable field.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• converting headers to json: %w
• error encoding version spec: %v
• error building annotation patch: %v
• building node patch: %w
• error building node patch: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a816fd14a7e82da1. Report an issue: GitHub.