kubernetes/kops · error

encoding ECR credential provider config: %w

Error message

encoding ECR credential provider config: %w

What it means

addECRCredentialProvider serializes the generated ECR credential provider kubelet config (api.CredentialProviderConfig) to YAML using kubeletV1Encoder. An encoder failure is wrapped as "encoding ECR credential provider config: %w". This is rare since the config is a simple static struct.

Source

Thrown at nodeup/pkg/model/kubelet.go:680

		providerConfig.Providers = []kubeletv1.CredentialProvider{
			{
				APIVersion:           "credentialprovider.kubelet.k8s.io/v1",
				Name:                 "ecr-credential-provider",
				MatchImages:          registryList,
				DefaultCacheDuration: &metav1.Duration{Duration: cacheDuration},
				Args:                 []string{"get-credentials"},
				Env: []kubeletv1.ExecEnvVar{
					{
						Name:  "AWS_REGION",
						Value: b.Cloud.Region(),
					},
				},
			},
		}

		var buf bytes.Buffer
		if err := kubeletV1Encoder.Encode(providerConfig, &buf); err != nil {
			return fmt.Errorf("encoding ECR credential provider config: %w", err)
		}

		c.AddTask(&nodetasks.File{
			Path:     credentialProviderConfigFilePath,
			Contents: fi.NewBytesResource(buf.Bytes()),
			Type:     nodetasks.FileType_File,
			Mode:     s("0644"),
		})
	}
	return nil
}

// addGCPCredentialProvider installs the GCP Kubelet Credential Provider
func (b *KubeletBuilder) addGCPCredentialProvider(c *fi.NodeupModelBuilderContext) error {
	{
		assetName := "auth-provider-gcp"
		assetPath := ""
		asset, err := b.Assets.Find(assetName, assetPath)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error to identify which field fails to marshal.
2. Rebuild nodeup from the matching kOps version; report a kOps bug if it reproduces on unmodified code.
3. Verify the kubelet API types vendored in the build match the intended k8s version (kubeletV1Encoder).

var buf bytes.Buffer
if err := kubeletV1Encoder.Encode(providerConfig, &buf); err != nil {
	return fmt.Errorf("encoding ECR credential provider config: %w", err)
}
// caller: treat as unrecoverable build error; capture the wrapped cause for a bug report
if strings.Contains(err.Error(), "encoding ECR credential provider config") {
	klog.Errorf("ECR provider config marshal failed: %v", errors.Unwrap(err))
}

When it happens

Trigger: kubeletV1Encoder.Encode(providerConfig, &buf) returns an error while marshaling the CredentialProviderConfig containing the ecr-credential-provider entry — e.g. a marshaling bug, interface conversion problem, or an unsupported field introduced by a code change.

Common situations: Encountered during kOps development/forks after modifying the provider config struct; essentially never seen from user configuration because the config is constructed in code.

Related errors

• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• error loading AWS config: %v
• finding primary network interface: %w
• loading AWS config: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5041c35d5e1bf44f. Report an issue: GitHub.