What causes "kind: %w" in t8y2/dbx?

Regenerate the delegation token from the Hive server

kind: %w

Error message

kind: %w

What it means

This error is returned while parsing a Hadoop delegation token: the third length-prefixed byte array (the token kind, e.g. 'HIVE_DELEGATION_TOKEN') could not be read. Identifier and password parsed successfully but the stream is corrupt or truncated before the kind field completes.

Source

Thrown at agents/drivers/argo-go/config.go:787

		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))
	identifier, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("identifier: %w", err)
	}
	password, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("password: %w", err)
	}
	if len(identifier) == 0 || len(password) == 0 {
		return nil, nil, errors.New("token identifier and password must be non-empty")
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}

View on GitHub (pinned to c0390bff16)

Solutions

Regenerate the delegation token from the Hive server
Verify the full base64 token string is intact end to end
Do not construct or edit token strings manually
Compare token length against the value the issuing server reported

Example fix

// before
token := base64.StdEncoding.EncodeToString(identifierAndPasswordOnly)
// after
token := issuedToken // use the token exactly as issued by the server

Defensive patterns

Strategy: validation

Validate before calling

func checkTokenMinFields(token string) error {
	decoded, err := base64.StdEncoding.DecodeString(token)
	if err != nil { return err }
	if len(decoded) < 40 { return errors.New("token missing trailing fields (kind/service)") }
	return nil
}

Try / catch

if _, _, err := decodeHadoopDelegationToken(token); err != nil {
	if strings.Contains(err.Error(), "kind") {
		log.Println("token incomplete: kind field unreadable — reissue token")
	}
	return err
}

Prevention

Use the token exactly as issued; never reconstruct it manually
Round-trip test base64 encode/decode in CI for stored tokens
Avoid text-mode transformations (editors, email, chat) on token strings

When it happens

Trigger: Decoding a delegation token whose payload ends partway through the kind field, or whose kind length prefix is corrupt.

Common situations: Severely truncated token; token mutated in transit; constructing tokens manually with missing fields.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/f25468058200a749. Report an issue: GitHub.