kubernetes/kops · error

failed to sign data: %w

Error message

failed to sign data: %w

What it means

The low-level sign helper failed: the crypto.Signer returned an error signing the SHA-256 digest, typically a TPM signing failure (handle revoked, session expiry) or an entropy-source problem with the supplied cryptorand.Reader.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:145

		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return AuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

// sign performs a TPM signature with the tpmKey, and sanity checks the result.
func (a *pkiAuthenticator) sign(payload []byte) ([]byte, error) {
	beforeSign := time.Now()

	digest := sha256.Sum256(payload)

	signature, err := a.signer.Sign(cryptorand.Reader, digest[:], crypto.SHA256)
	if err != nil {
		return nil, fmt.Errorf("failed to sign data: %w", err)
	}

	klog.Infof("signing took %v", time.Since(beforeSign))

	return signature, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify TPM/key-provider health and reload the key handle
2. Restart the process or node to reinitialize the signer
3. Inspect the wrapped error for provider-specific status codes

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:145 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c16bf0580ac273f. Report an issue: GitHub.