{"record":{"id":"a2af19bce1c05d7c","repo":"rancher/rancher","slug":"unable-to-decode-google-oauth-config-w","errorCode":null,"errorMessage":"unable to decode Google Oauth Config: %w","messagePattern":"unable to decode Google Oauth Config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/googleoauth/goauth_provider.go","lineNumber":327,"sourceCode":"\t}\n\treturn allowed, nil\n}\n\nfunc (g *googleOauthProvider) getGoogleOAuthConfigCR() (*apiv3.GoogleOauthConfig, error) {\n\tauthConfigObj, err := g.authConfigs.ObjectClient().UnstructuredClient().Get(Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve GoogleOAuthConfig, error: %v\", err)\n\t}\n\tu, ok := authConfigObj.(runtime.Unstructured)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve GoogleOAuthConfig, cannot read k8s Unstructured data\")\n\t}\n\tstoredGoogleOAuthConfigMap := u.UnstructuredContent()\n\n\tstoredGoogleOAuthConfig := &apiv3.GoogleOauthConfig{}\n\terr = common.Decode(storedGoogleOAuthConfigMap, storedGoogleOAuthConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to decode Google Oauth Config: %w\", err)\n\t}\n\n\tif storedGoogleOAuthConfig.OauthCredential != \"\" {\n\t\tvalue, err := common.ReadFromSecret(g.secrets, storedGoogleOAuthConfig.OauthCredential, strings.ToLower(client.GoogleOauthConfigFieldOauthCredential))\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tstoredGoogleOAuthConfig.OauthCredential = value\n\t}\n\n\tif storedGoogleOAuthConfig.ServiceAccountCredential != \"\" {\n\t\tvalue, err := common.ReadFromSecret(g.secrets, storedGoogleOAuthConfig.ServiceAccountCredential, strings.ToLower(client.GoogleOauthConfigFieldServiceAccountCredential))\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tstoredGoogleOAuthConfig.ServiceAccountCredential = value\n\t}\n\treturn storedGoogleOAuthConfig, nil","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/googleoauth/goauth_provider.go#L309-L345","documentation":"common.Decode failed while converting the AuthConfig CR's unstructured map into a typed apiv3.GoogleOauthConfig. This means the CR exists and was fetched, but its stored fields do not match the expected schema — wrong field types, unknown/renamed fields, or values that cannot be unmarshalled into the typed struct. The underlying decode error is chained with %w.","triggerScenarios":"Someone hand-edited kubectl edit authconfigs googleoauth and introduced a type mismatch (e.g. strings where the schema expects booleans or numbers); a CR written by an older/newer Rancher version with a schema drift; applying a YAML manifest with indented or quoted values that decode differently.","commonSituations":"GitOps-managed AuthConfig CRs drifting from the schema; Rancher upgrade where GoogleOauthConfig fields changed; manual kubectl edits; CRs restored from a different cluster/version backup.","solutions":["Read the chained error — it names the exact field and reason (e.g. cannot unmarshal string into bool)","kubectl get authconfigs googleoauth -o yaml and fix or remove the offending field","If schema drift from an upgrade, disable/re-enable Google OAuth via testAndApply to rewrite the CR cleanly","Keep AuthConfig CRs out of untested GitOps pipelines or validate them against the current CRD"],"exampleFix":"# before (bad field type in CR)\nspec:\n  accessMode: \"unrestricted\"   # plus a stray numeric field like minuxSeconds: \"abc\"\n\n# after: delete bad fields and re-apply\nkubectl patch authconfigs googleoauth --type=merge -p '{\"spec\":{\"minuxSeconds\":null}}'","handlingStrategy":"validation","validationCode":"// yaml decodes and round-trips the CR to catch schema mismatches before use:\n// kubectl apply --dry-run=server -f googleoauth-authconfig.yaml\n# any field rejected by the CRD here would otherwise surface as the decode error later","typeGuard":null,"tryCatchPattern":"err := common.Decode(storedGoogleOAuthConfigMap, storedGoogleOAuthConfig)\nif err != nil {\n    return nil, fmt.Errorf(\"GoogleOAuthConfig CR is malformed (%w); run 'kubectl get authconfigs googleoauth -o yaml' and fix or delete the bad fields\", err)\n}","preventionTips":["Never hand-edit AuthConfig CRs; use the testAndApply flow","Server-side dry-run CRs in GitOps pipelines","Recreate the CR via disable/re-enable after version upgrades instead of carrying drifted YAML"],"tags":["go","kubernetes","schema","decode","google-oauth"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}