{"record":{"id":"b783f0d972e9ebef","repo":"weaviate/weaviate","slug":"rbac-is-expected-to-be-enabled-but-the-controller","errorCode":null,"errorMessage":"RBAC is expected to be enabled, but the controller wasn't initialized","messagePattern":"RBAC is expected to be enabled, but the controller wasn't initialized","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"adapters/handlers/rest/configure_server.go","lineNumber":190,"sourceCode":"\t\t\tappState.NamespacesController,\n\t\t\tappState.Logger)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"can't init casbin %w\", err)\n\t\t}\n\n\t\tappState.AuthzController = rbacController\n\t\tappState.RBAC = rbacController\n\t\tappState.Authorizer = rbacController\n\t} else if appState.ServerConfig.Config.Authorization.AdminList.Enabled {\n\t\tappState.Authorizer = adminlist.New(appState.ServerConfig.Config.Authorization.AdminList)\n\t} else {\n\t\tappState.Authorizer = &authorization.DummyAuthorizer{}\n\t}\n\n\tif appState.ServerConfig.Config.Authorization.Rbac.Enabled && appState.RBAC == nil {\n\t\t// this in general shall not happen, it's to catch cases were RBAC expected but we weren't able\n\t\t// to assign it.\n\t\treturn fmt.Errorf(\"RBAC is expected to be enabled, but the controller wasn't initialized\")\n\t}\n\n\treturn nil\n}\n\nfunc timeTillDeadline(ctx context.Context) string {\n\tdl, _ := ctx.Deadline()\n\treturn time.Until(dl).String()\n}\n","sourceCodeStart":172,"sourceCodeEnd":200,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/adapters/handlers/rest/configure_server.go#L172-L200","documentation":"A startup sanity check in configureAuthorizer: RBAC is enabled in config but `appState.RBAC` was never assigned, meaning the rbac.New branch either didn't run or failed to assign the controller. Weaviate treats this as an invariant violation and refuses to start, because serving requests with RBAC enabled but no enforcer would silently bypass authorization.","triggerScenarios":"`authorization.rbac.enabled=true` while configureAuthorizer returned from a different branch (e.g. rbac.New was skipped due to an internal condition, or an earlier wrapped failure left appState.RBAC nil before this guard ran). The comment in the source says this \"in general shall not happen\" — it catches partially failed initialization.","commonSituations":"Patched/custom builds where the RBAC assignment path was altered; config where both rbac and admin_list flags interact unexpectedly; race or partial failure during startupRoutine before the earlier rbac.New error could abort startup.","solutions":["Look for a preceding \"can't init casbin\" error in the logs; fix that root cause — this guard is its downstream symptom.","Confirm `authorization.rbac.enabled` matches intent; if you meant admin-list or no auth, correct the config.","Ensure the RBAC controller assignment (appState.RBAC = rbacController) executes on every path where RBAC is enabled; rebuild from an unmodified release.","If reproducible on a stock build, report with full startup logs and config (redact secrets)."],"exampleFix":"// before: enabled RBAC while pointing admin list on, masking the rbac branch\nauthorization:\n  rbac: { enabled: true }\n  admin_list: { enabled: true, users: [...] }\n// after: single coherent authorization mode\nauthorization:\n  rbac: { enabled: true }\n  admin_list: { enabled: false }","handlingStrategy":"validation","validationCode":"// config sanity before startup: exactly one authorization mode, consistent flags\ndef validate_authz(cfg):\n    rbac = cfg['authorization']['rbac']['enabled']\n    admin = cfg['authorization']['admin_list']['enabled']\n    assert not (rbac and not rbac_supported()), \"RBAC enabled but build/config path unavailable\"\n    assert rbac or admin or cfg['authorization'].get('allow_anonymous'), \"no authorizer mode configured\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep RBAC and admin_list flags coherent — don't mix modes across partial config updates.","Deploy stock release binaries; treat any local patch to configureAuthorizer as high-risk.","On this error, immediately grep logs for the earlier 'can't init casbin' root cause.","Run startup smoke tests in staging with the same authorization config as production."],"tags":["startup","rbac","authorization","invariant"],"backgroundTag":"rbac-controller-not-initialized","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}