kubernetes/kops · error

failed to marshal token: %w

Error message

failed to marshal token: %w

What it means

Marshaling the outer AuthToken envelope (data plus signature) to JSON failed; a defensive wrap over what is effectively an infallible struct marshal, so occurrence indicates internal inconsistency.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:132

	}

	payload, err := json.Marshal(&data)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token data: %w", err)
	}

	signature, err := a.sign(payload)
	if err != nil {
		return "", fmt.Errorf("failed to sign token data: %w", err)
	}
	token := &AuthToken{
		Data:      payload,
		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return AuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

// sign performs a TPM signature with the tpmKey, and sanity checks the result.
func (a *pkiAuthenticator) sign(payload []byte) ([]byte, error) {
	beforeSign := time.Now()

	digest := sha256.Sum256(payload)

	signature, err := a.signer.Sign(cryptorand.Reader, digest[:], crypto.SHA256)
	if err != nil {
		return nil, fmt.Errorf("failed to sign data: %w", err)
	}

	klog.Infof("signing took %v", time.Since(beforeSign))

	return signature, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Non-retryable internal error; report it with the wrapped error
2. Check for memory pressure on the node
3. Report as a bug if reproducible

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b67eb3b1f7f67cb0. Report an issue: GitHub.