kubernetes/kops · error

failed to marshal token data: %w

Error message

failed to marshal token data: %w

What it means

After building the AuthTokenData struct (audience, request hash), CreateToken serializes it with json.Marshal. This error wraps any failure of that marshal step. In practice it is near-impossible with this plain struct, so it indicates a programming error or an exotic json.Marshaler bug rather than an environment problem.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:98

	}
	defer key.Close()

	klog.V(2).Infof("attestation key is %v", debugToPEM(key.PublicKey()))

	klog.Infof("TPM initialization took %v", time.Since(tpmStart))

	data := gcetpm.AuthTokenData{
		GCPProjectID: a.projectID,
		Zone:         a.zone,
		Instance:     a.instance,
		Timestamp:    time.Now().Unix(),
		Audience:     gcetpm.AudienceNodeAuthentication,
		RequestHash:  requestHash[:],
	}

	payload, err := json.Marshal(&data)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token data: %w", err)
	}

	signature, err := tpmSign(key, payload)
	if err != nil {
		return "", fmt.Errorf("failed to sign token data: %w", err)
	}
	token := &gcetpm.AuthToken{
		Data:      payload,
		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return gcetpm.GCETPMAuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error for the offending field/type
2. Remove or fix any custom MarshalJSON implementation on gcetpm.AuthTokenData
3. Ensure all struct fields are JSON-serializable types
4. Rebuild with the version of kops/gcetpm package that matches your vendored types

Example fix

null

if _, err := json.Marshal(gcetpm.AuthTokenData{}); err != nil {
    // detect serialization problem in struct definition early (tests)
    panic(err)
}

token, err := authenticator.CreateToken(ctx, request)
if err != nil {
    var me *json.MarshalTypeError
    if errors.As(err, &me) { log.Fatalf("bad field %s", me.Field) }
    return err
}

When it happens

Trigger: json.Marshal(&data) returns an error — only possible if AuthTokenData (or a field of it) implements MarshalJSON and fails, or an unsupported type is present.

Common situations: Custom MarshalJSON on AuthTokenData that panics/returns error after a refactor; adding an unsupported field type (chan, func) to the struct.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• failed to marshal token: %w
• unmarshalling authorization token: %w
• unmarshalling authorization token data: %w
• error building annotation patch: %v
• building node patch: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e5f868d375342aca. Report an issue: GitHub.