rancher/rancher · error

failed to convert token key to hash: %w

Error message

failed to convert token key to hash: %w

What it means

EnsureClusterToken hashes the generated token key before storing it (ConvertTokenKeyToHash in pkg/auth/tokens/token_util.go). Hashing only runs when the token-hashing feature flag is enabled; the hasher (hashers.GetHasher, bcrypt-backed) can fail on pathological inputs (e.g. keys longer than bcrypt's 72-byte limit) or hasher construction errors. Because the key is server-generated with a fixed format, this error is rare and indicates an environment/feature-flag anomaly rather than user input.

Source

Thrown at pkg/auth/tokens/manager.go:679

		TTLMillis:     0,
		Description:   input.Description,
		UserID:        input.UserName,
		AuthProvider:  input.AuthProvider,
		UserPrincipal: input.UserPrincipal,
		IsDerived:     true,
		Token:         key,
		ClusterName:   clusterName,
	}
	if input.TTL != nil {
		token.TTLMillis = *input.TTL
	}
	if input.Randomize {
		token.ObjectMeta.Name = ""
		token.ObjectMeta.GenerateName = input.TokenName
	}
	err = ConvertTokenKeyToHash(token)
	if err != nil {
		return "", nil, fmt.Errorf("failed to convert token key to hash: %w", err)
	}

	logrus.Infof("Creating token for user %s", input.UserName)
	err = wait.ExponentialBackoff(backoff, func() (bool, error) {
		// Backoff was added here because it is possible the token is in the process of deleting.
		// This should cause the create to retry until the delete is finished.
		newToken, err := m.tokens.Create(token)
		if err != nil {
			if apierrors.IsAlreadyExists(err) {
				return false, nil
			}
			return false, err
		}
		token = newToken
		return true, nil
	})
	if err != nil {
		return "", nil, err

View on GitHub (pinned to 932558d4e6)

Solutions

1. Check the preceding log line 'Failed to generate hash from token' for the root cause
2. If you control key generation, keep keys well under 72 bytes
3. Report upstream if it reproduces with a stock Rancher build and server-generated keys

// Cap custom token keys before they reach the hasher
const maxBcryptInput = 72
if len(token.Token) > maxBcryptInput {
    return fmt.Errorf("token key exceeds %d bytes and cannot be hashed", maxBcryptInput)
}

func hashableTokenKey(key string) bool {
    return len(key) > 0 && len(key) <= 72
}

if _, _, err := mgr.EnsureClusterToken(clusterName, input); err != nil {
    if strings.Contains(err.Error(), "failed to convert token key to hash") {
        // hashing-stage failure: check token-hashing feature config and key length, do not blind-retry
        return diagnoseHasherConfig()
    }
    return err
}

When it happens

Trigger: Creating a cluster/kubeconfig token with features.TokenHashing enabled while hasher.CreateHash fails — an oversized key (custom build injecting long keys) or a corrupted hasher configuration.

Common situations: Enabling token hashing on a build with a custom hasher; downstream forks generating non-standard key lengths.

Related errors

• invalid credentials
• Unauthorized
• activedirectory: error binding service account: %w
• no identities can be retrieved
• getting OID from IDToken: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/d90091b5807fcd50. Report an issue: GitHub.