{"record":{"id":"c16150d370b8ac44","repo":"gravitational/teleport","slug":"unknown-integration-subkind-s","errorCode":null,"errorMessage":"unknown integration subkind: %s","messagePattern":"unknown integration subkind: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/integration/integrationv1/service.go","lineNumber":489,"sourceCode":"\t\tigMeta.AWSOIDC = &apievents.AWSOIDCIntegrationMetadata{\n\t\t\tRoleARN:     ig.GetAWSOIDCIntegrationSpec().RoleARN,\n\t\t\tIssuerS3URI: ig.GetAWSOIDCIntegrationSpec().IssuerS3URI,\n\t\t}\n\tcase types.IntegrationSubKindAzureOIDC:\n\t\tigMeta.AzureOIDC = &apievents.AzureOIDCIntegrationMetadata{\n\t\t\tTenantID: ig.GetAzureOIDCIntegrationSpec().TenantID,\n\t\t\tClientID: ig.GetAzureOIDCIntegrationSpec().ClientID,\n\t\t}\n\tcase types.IntegrationSubKindGitHub:\n\t\tigMeta.GitHub = &apievents.GitHubIntegrationMetadata{\n\t\t\tOrganization: ig.GetGitHubIntegrationSpec().Organization,\n\t\t}\n\tcase types.IntegrationSubKindAWSRolesAnywhere:\n\t\tigMeta.AWSRA = &apievents.AWSRAIntegrationMetadata{\n\t\t\tTrustAnchorARN: ig.GetAWSRolesAnywhereIntegrationSpec().TrustAnchorARN,\n\t\t}\n\tdefault:\n\t\treturn apievents.IntegrationMetadata{}, fmt.Errorf(\"unknown integration subkind: %s\", igMeta.SubKind)\n\t}\n\n\treturn igMeta, nil\n}\n\n// DeleteAllIntegrations removes all Integration resources.\n// DEPRECATED: can't delete all integrations over gRPC.\nfunc (s *Service) DeleteAllIntegrations(ctx context.Context, _ *integrationpb.DeleteAllIntegrationsRequest) (*emptypb.Empty, error) {\n\treturn nil, trace.BadParameter(\"DeleteAllIntegrations is deprecated\")\n}\n\nfunc (s *Service) ensureNoAssociatedResources(ctx context.Context, ig types.Integration) error {\n\tswitch ig.GetSubKind() {\n\tcase types.IntegrationSubKindGitHub:\n\t\treturn trace.Wrap(s.ensureNoGitHubAssociatedResources(ctx, ig))\n\tdefault:\n\t\t// TODO support this check for other types.\n\t\treturn nil","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/integration/integrationv1/service.go#L471-L507","documentation":"This error is returned by getIntegrationMetadata in Teleport's integration service when an Integration resource has a SubKind that the metadata builder does not recognize. The switch statement maps known integration subkinds (e.g. AWS OIDC, AWS Roles Anywhere) to their event metadata structs; any other subkind falls into the default branch. It indicates a subkind was added to the types package but not to this metadata mapping, or a client supplied an invalid/unsupported subkind.","triggerScenarios":"Calling CreateIntegration, UpdateIntegration, or DeleteIntegration with an Integration whose spec SubKind is not one handled by the switch (e.g. a newly introduced subkind lacking a case, a typo'd subkind string, or a resource created by a newer Teleport version parsed by an older one).","commonSituations":"Running an older Teleport auth server against integration resources created by a newer version; hand-crafted YAML for integrations with an invalid spec.sub_kind; plugin development where a new IntegrationSubKind constant was defined in types but the audit-event metadata mapping in lib/auth/integration/integrationv1 was not updated.","solutions":["Check the Integration resource's spec.sub_kind for typos or unsupported values and correct it to a valid subkind (e.g. aws-oidc, aws-roles-anywhere).","Upgrade all Teleport components (auth server, proxies) to the same version so newly introduced subkinds are recognized.","If you are adding a new integration subkind in code, add a case for types.IntegrationSubKind<New> in getIntegrationMetadata that populates the corresponding apievents metadata struct.","Verify no stale/corrupt integration resources exist in the backend (tctl get integrations) and delete invalid ones."],"exampleFix":"// before (new subkind added in types but no case here)\ncase types.IntegrationSubKindAWSRolesAnywhere:\n    ...\ndefault:\n    return apievents.IntegrationMetadata{}, fmt.Errorf(\"unknown integration subkind: %s\", igMeta.SubKind)\n// after\ncase types.IntegrationSubKindAWSRolesAnywhere:\n    ...\ncase types.IntegrationSubKindMyNewKind:\n    igMeta.MyNew = &apievents.MyNewIntegrationMetadata{ ... }\ndefault:\n    return apievents.IntegrationMetadata{}, fmt.Errorf(\"unknown integration subkind: %s\", igMeta.SubKind)","handlingStrategy":"validation","validationCode":"const knownSubkinds = map[string]bool{\"aws-oidc\": true, \"aws-roles-anywhere\": true}\nif !knownSubkinds[ig.GetSubKind()] {\n    return fmt.Errorf(\"integration subkind %q not supported by this Teleport version\", ig.GetSubKind())\n}","typeGuard":"func isSupportedIntegrationSubKind(sk types.IntegrationSubKind) bool {\n    switch sk {\n    case types.IntegrationSubKindAWSOIDC, types.IntegrationSubKindAWSRolesAnywhere:\n        return true\n    }\n    return false\n}","tryCatchPattern":"igMeta, err := getIntegrationMetadata(ig)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"unknown integration subkind\") {\n        return trace.BadParameter(\"integration %q has unsupported subkind %q; upgrade Teleport or fix the resource\", ig.GetName(), ig.GetSubKind())\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Pin all Teleport components to the same version before creating new integration types.","Validate spec.sub_kind against tctl-supported values when authoring integration YAML.","When adding a new IntegrationSubKind in types, immediately add its case in getIntegrationMetadata (search for the default branch)."],"tags":["teleport","integrations","unhandled-case"],"backgroundTag":"invalid-enum-value","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}