{"record":{"id":"7be8827a8f843363","repo":"rancher/rancher","slug":"failed-to-retrieve-azureadconfig-cannot-read-k8s","errorCode":null,"errorMessage":"failed to retrieve AzureADConfig, cannot read k8s Unstructured data","messagePattern":"failed to retrieve AzureADConfig, cannot read k8s Unstructured data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/azure/azure_provider.go","lineNumber":456,"sourceCode":"\tconfig.ApplicationSecret = name\n\n\tlogrus.Debugf(\"updating AzureADConfig\")\n\t_, err = ap.authConfigs.ObjectClient().Update(config.Name, config)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\nfunc (ap *Provider) GetAzureConfigK8s() (*apiv3.AzureADConfig, error) {\n\tauthConfigObj, err := ap.Retriever.Get(Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve AzureADConfig, error: %v\", err)\n\t}\n\n\tu, ok := authConfigObj.(runtime.Unstructured)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve AzureADConfig, cannot read k8s Unstructured data\")\n\t}\n\tstoredAzureADConfigMap := u.UnstructuredContent()\n\n\tstoredAzureADConfig := &apiv3.AzureADConfig{}\n\terr = common.Decode(storedAzureADConfigMap, storedAzureADConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to decode Azure Config: %w\", err)\n\t}\n\n\tif storedAzureADConfig.ApplicationSecret != \"\" {\n\t\tvalue, err := common.ReadFromSecret(ap.secrets, storedAzureADConfig.ApplicationSecret,\n\t\t\tstrings.ToLower(client.AzureADConfigFieldApplicationSecret))\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tstoredAzureADConfig.ApplicationSecret = value\n\t}\n","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/azure/azure_provider.go#L438-L474","documentation":"The object returned by Retriever.Get failed the runtime.Unstructured type assertion (azure_provider.go:456): the getter returned a typed object where unstructured content is required. Production wiring uses the wrangler unstructured client, so this appears with custom Retrievers (tests) or a changed wrangler client type.","triggerScenarios":"A test or fork injects a Retriever whose Get returns *v3.AuthConfig or another typed runtime.Object instead of *unstructured.Unstructured.","commonSituations":"Unit tests with fake getters; forks replacing the unstructured client.","solutions":["Return *unstructured.Unstructured from stub Retriever implementations","Wire Retriever through mgmtCtx.Management.AuthConfigs(\"\").ObjectClient().UnstructuredClient() as Configure does","Keep the wrangler version consistent with the provider build"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func isUnstructured(obj runtime.Object) bool {\n\t_, ok := obj.(runtime.Unstructured)\n\treturn ok\n}","tryCatchPattern":null,"preventionTips":["Wire Retriever exactly as Configure does: UnstructuredClient() from the wrangler AuthConfig interface","Fakes in tests must return *unstructured.Unstructured"],"tags":["kubernetes","go","type-assertion","testing"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}