{"record":{"id":"39c00fedc01c4a73","repo":"rancher/rancher","slug":"failed-to-retrieve-githubconfig-error-v","errorCode":null,"errorMessage":"failed to retrieve GithubConfig, error: %v","messagePattern":"failed to retrieve GithubConfig, error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/github/github_provider.go","lineNumber":92,"sourceCode":"func (g *Provider) GetName() string {\n\treturn Name\n}\n\nfunc (g *Provider) CustomizeSchema(schema *types.Schema) {\n\tschema.ActionHandler = g.actionHandler\n\tschema.Formatter = g.formatter\n}\n\nfunc (g *Provider) TransformToAuthProvider(authConfig map[string]any) (map[string]any, error) {\n\tp := common.TransformToAuthProvider(authConfig)\n\tp[publicclient.GithubProviderFieldRedirectURL] = formGithubRedirectURLFromMap(authConfig)\n\treturn p, nil\n}\n\nfunc (g *Provider) getGithubConfigCR() (*apiv3.GithubConfig, error) {\n\tauthConfigObj, err := g.authConfigs.ObjectClient().UnstructuredClient().Get(Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve GithubConfig, error: %v\", err)\n\t}\n\tu, ok := authConfigObj.(runtime.Unstructured)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve GithubConfig, cannot read k8s Unstructured data\")\n\t}\n\tstoredGithubConfigMap := u.UnstructuredContent()\n\n\tstoredGithubConfig := &apiv3.GithubConfig{}\n\terr = common.Decode(storedGithubConfigMap, storedGithubConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to decode Github Config: %w\", err)\n\t}\n\n\tif storedGithubConfig.ClientSecret != \"\" {\n\t\tdata, err := common.ReadFromSecretData(g.secrets, storedGithubConfig.ClientSecret)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/github/github_provider.go#L74-L110","documentation":"Provider.getGithubConfigCR fails to GET the GithubConfig custom resource from the management cluster via the unstructured object client. This is a Kubernetes API-level failure: most often NotFound because the CR does not exist yet, but also RBAC denials, timeouts, or an unreachable API server.","triggerScenarios":"Applying/deleting the GithubConfig CR while a login or search is in flight; Rancher bootstrapping before the CR is created; the management-cluster service account lacking get on authconfigs; API server connection issues from the pod.","commonSituations":"Fresh installs where GitHub auth was enabled but the CR name is not exactly 'github'; helm upgrades that briefly remove the CR; kubectl apply of auth config with a wrong name/namespace; tightened PSA/RBAC blocking cattle controllers.","solutions":["Run: kubectl get authconfigs -A (or GithubConfig CR) and confirm an object named 'github' exists in the expected namespace.","Check controller pod logs/rbac: kubectl auth can-i get authconfigs --as=system:serviceaccount:<ns>:<sa>.","If the CR was deleted, recreate it via the auth provider UI/API so it is written back.","Retry once after a short delay if this hit during an upgrade window."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-flight: does the CR exist and is it gettable?\n_, err := dynamicClient.Resource(gvr).Namespace(ns).Get(ctx, \"github\", metav1.GetOptions{})\nif apierrors.IsNotFound(err) {\n    return errors.New(\"GithubConfig CR not found — enable/configure the GitHub auth provider first\")\n}\nif err != nil {\n    return fmt.Errorf(\"checking GithubConfig: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"cfg, err := g.getGithubConfigCR()\nif err != nil {\n    if apierrors.IsNotFound(errors.Unwrap(err)) {\n        // provider not configured: degrade gracefully, prompt setup\n        return handleUnconfiguredProvider()\n    }\n    return err // RBAC / API server issues: surface for operators\n}","preventionTips":["Pin the GithubConfig CR in git (helm/kustomize) so deletes are self-healing.","Alert on authConfig get failures from the auth controllers.","Never hand-delete the CR during active login traffic; disable the provider through the API instead."],"tags":["kubernetes","custom-resource","rbac","auth-config"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}