kubernetes/kops · error

failed to sign token data: %w

Error message

failed to sign token data: %w

What it means

The crypto.Signer refused to sign the marshaled token payload: a TPM- or KMS-backed signer failed the operation (TPM session lost, key handle invalidated, entropy source exhausted) after the payload was successfully built.

Source

Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:123

	requestHash := sha256.Sum256(body)

	data := AuthTokenData{
		Timestamp:   time.Now().Unix(),
		Audience:    AudienceNodeAuthentication,
		RequestHash: requestHash[:],

		KeyID:    a.keyID,
		Instance: a.hostname,
	}

	payload, err := json.Marshal(&data)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token data: %w", err)
	}

	signature, err := a.sign(payload)
	if err != nil {
		return "", fmt.Errorf("failed to sign token data: %w", err)
	}
	token := &AuthToken{
		Data:      payload,
		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return AuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

// sign performs a TPM signature with the tpmKey, and sanity checks the result.
func (a *pkiAuthenticator) sign(payload []byte) ([]byte, error) {
	beforeSign := time.Now()

	digest := sha256.Sum256(payload)

View on GitHub (pinned to 4c8573c808)

Solutions

1. For TPM signers, verify the TPM is present and the key handle is still loaded (tpm2 tools)
2. Restart the node/bootstrap agent to re-establish the signer session
3. Inspect the wrapped error for the underlying provider status

When it happens

Trigger: Thrown at pkg/bootstrap/pkibootstrap/pkisigner.go:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a3876acd92c522f6. Report an issue: GitHub.