{"record":{"id":"5faa47133f6bf2aa","repo":"k3s-io/k3s","slug":"not-authorized","errorCode":null,"errorMessage":"not authorized","messagePattern":"not authorized","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"pkg/server/auth/auth.go","lineNumber":43,"sourceCode":")\n\nfunc hasRole(mustRoles []string, roles []string) bool {\n\tfor _, check := range roles {\n\t\tfor _, role := range mustRoles {\n\t\t\tif role == check {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n\treturn false\n}\n\n// doAuth calls the cluster's authenticator to validate that the client has at least one of the listed roles\nfunc doAuth(roles []string, serverConfig *config.Control, next http.Handler, rw http.ResponseWriter, req *http.Request) {\n\tswitch {\n\tcase serverConfig == nil:\n\t\tlogrus.Errorf(\"Authenticate not initialized: serverConfig is nil\")\n\t\tutil.SendError(errors.New(\"not authorized\"), rw, req, http.StatusUnauthorized)\n\t\treturn\n\tcase serverConfig.Runtime.Authenticator == nil:\n\t\tlogrus.Errorf(\"Authenticate not initialized: serverConfig.Runtime.Authenticator is nil\")\n\t\tutil.SendError(errors.New(\"not authorized\"), rw, req, http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\tresp, ok, err := serverConfig.Runtime.Authenticator.AuthenticateRequest(req)\n\tif err != nil {\n\t\tlogrus.Errorf(\"Failed to authenticate request from %s: %v\", req.RemoteAddr, err)\n\t\tutil.SendError(errors.New(\"not authorized\"), rw, req, http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\tif !ok || !hasRole(roles, resp.User.GetGroups()) {\n\t\tutil.SendError(errors.New(\"forbidden\"), rw, req, http.StatusForbidden)\n\t\treturn\n\t}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/auth/auth.go#L25-L61","documentation":"Thrown by doAuth in pkg/server/auth/auth.go when the HasRole/IsLocalOrHasRole middleware runs but the *config.Control pointer passed to the router is nil. k3s refuses to authorize the request because there is no server configuration at all, and returns HTTP 401 with body 'not authorized'. This is a wiring/startup-order defect, not a credential problem.","triggerScenarios":"An HTTP request reaches a role-protected supervisor endpoint (routes built with auth.HasRole / auth.IsLocalOrHasRole, e.g. the /v1-k3s runtime endpoints) while the serverConfig handed to handlers.Register is nil. Happens in custom builds that mount the k3s router with a nil control config, in unit tests that exercise the middleware without config, or if a request slips in before server setup assigns the config.","commonSituations":"Embedding k3s handlers in a test harness or fork; racing a request against server startup; refactors that construct routers before config.Control exists.","solutions":["Check the k3s server log for 'Authenticate not initialized: serverConfig is nil' - it identifies this exact case.","If you embed or fork k3s, make sure the value passed to auth.HasRole(...) / handlers.Register is a non-nil *config.Control before the mux starts serving.","If you are a normal client, wait for the server to fully start (poll /v1-k3s/readyz or the readyz endpoint) before calling protected endpoints.","Restart the server process if it was started with a broken/absent configuration."],"exampleFix":"// before (fork/embedding): router with nil config\nmux.Handle(\"/v1-k3s/runtime\", auth.HasRole(nil, \"system:masters\")(h))\n\n// after: pass the initialized control config\nmux.Handle(\"/v1-k3s/runtime\", auth.HasRole(control, \"system:masters\")(h))","handlingStrategy":"validation","validationCode":"// Before serving, ensure the control config is wired (embedding/tests)\nfunc routerReady(control *config.Control) error {\n    if control == nil {\n        return errors.New(\"control config is nil; do not mount auth.HasRole routes\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Poll /v1-k3s/readyz (or readyz) before calling role-protected supervisor endpoints.","In forks/tests, never construct auth.HasRole(nil, ...); assert control != nil in a startup gate.","Watch server logs for 'Authenticate not initialized' to catch wiring problems early."],"tags":["auth","http","k3s","middleware","startup","nil-safety"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}