{"record":{"id":"ca49000b8c45c8f4","repo":"rancher/rancher","slug":"failed-to-create-userattribute-w","errorCode":null,"errorMessage":"failed to create UserAttribute: %w","messagePattern":"failed to create UserAttribute: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/common/usermanager.go","lineNumber":408,"sourceCode":"\t}\n\n\tif m.userAttributeChanged(attribs, provider, userExtraInfo, groupPrincipals) {\n\t\tshouldUpdate = true\n\t}\n\tif len(loginTime) > 0 && !loginTime[0].IsZero() {\n\t\t// Login time is truncated to seconds as the corresponding user label is set as epoch time.\n\t\tlastLogin := metav1.NewTime(loginTime[0].Truncate(time.Second))\n\t\tattribs.LastLogin = &lastLogin\n\t\tshouldUpdate = true\n\t}\n\n\tattribs.GroupPrincipals[provider] = v3.Principals{Items: groupPrincipals}\n\tattribs.ExtraByProvider[provider] = userExtraInfo\n\n\tif needCreate {\n\t\t_, err = m.userAttributes.Create(attribs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create UserAttribute: %w\", err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif shouldUpdate {\n\t\t_, err = m.userAttributes.Update(attribs)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to update UserAttribute: %w\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (m *userManager) userAttributeChanged(attribs *v3.UserAttribute, provider string, extraInfo map[string][]string, groupPrincipals []v3.Principal) bool {\n\tif len(attribs.GroupPrincipals[provider].Items) != len(groupPrincipals) {\n\t\treturn true","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/common/usermanager.go#L390-L426","documentation":"During login, Rancher persists per-user group/extra info in a UserAttribute CR. This error fires when the initial Create of that CR fails. The wrapped error is the Kubernetes API cause.","triggerScenarios":"m.userAttributes.Create fails: CRD management.cattle.io/v3 UserAttribute not installed/removed, RBAC create denial, or an AlreadyExists race when two logins race to create the same UserAttribute.","commonSituations":"First login after upgrade before CRDs reconcile; clusters where rancher CRDs were pruned; concurrent logins of the same user from two sessions.","solutions":["Read the wrapped error: NotFound -> CRD missing, Forbidden -> RBAC, AlreadyExists -> race","Ensure the UserAttribute CRD exists (re-apply rancher CRDs)","Grant create on userattributes.management.cattle.io to the service account","On AlreadyExists races, re-fetch the attribute and fall through to the update path"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Check the CRD is established before enabling a provider that writes UserAttributes\n_, err := apiExt.ApiextensionsV1().CustomResourceDefinitions().Get(ctx, \"userattributes.management.cattle.io\", metav1.GetOptions{})\nif err != nil { return fmt.Errorf(\"UserAttribute CRD missing: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := m.saveUserAttributes(...); err != nil {\n    if apierrors.IsAlreadyExists(errors.Unwrap(err)) {\n        // concurrent login created it: fall through to update path\n        needCreate = false\n        return updatePath()\n    }\n    return err\n}","preventionTips":["Install/upgrade rancher CRDs fully before enabling auth providers","Handle AlreadyExists races by switching to update","Grant create on userattributes.management.cattle.io"],"tags":["kubernetes","crd","rancher","auth","userattributes"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}