derailed/k9s · error

expecting PolicyRes but got %T

Error message

expecting PolicyRes but got %T

What it means

Rbac.Render draws the RBAC policy browser rows and requires a *render.PolicyRes — the synthetic row type built by NewPolicyRes(ns, binding, res, group, verbs) when k9s flattens ClusterRoleBindings and RoleBindings into policy rows. The comma-ok assertion is on the pointer type, so a value PolicyRes or any other object fails with this error, which prints the concrete %T received.

Source

Thrown at internal/render/rbac.go:61

}

// Header returns a header row.
func (Rbac) Header(string) model1.Header {
	h := make(model1.Header, 0, 10)
	h = append(h,
		model1.HeaderColumn{Name: "NAME"},
		model1.HeaderColumn{Name: "API-GROUP"},
	)
	h = append(h, rbacVerbHeader()...)

	return append(h, model1.HeaderColumn{Name: "VALID", Attrs: model1.Attrs{Wide: true}})
}

// Render renders a K8s resource to screen.
func (r Rbac) Render(o any, ns string, ro *model1.Row) error {
	p, ok := o.(*PolicyRes)
	if !ok {
		return fmt.Errorf("expecting PolicyRes but got %T", o)
	}

	ro.ID = p.Resource
	ro.Fields = make(model1.Fields, 0, len(r.Header(ns)))
	ro.Fields = append(ro.Fields,
		cleanseResource(p.Resource),
		p.Group,
	)
	ro.Fields = append(ro.Fields, asVerbs(p.Verbs)...)
	ro.Fields = append(ro.Fields, "")

	return nil
}

// ----------------------------------------------------------------------------
// Helpers...

func asVerbs(verbs []string) []string {

View on GitHub (pinned to 2d3ccc6ba2)

Solutions

1. Always pass policies as *render.PolicyRes (the Policies collection already stores pointers)
2. Keep the Rbac renderer bound only to the policy/verbs views
3. Log the %T from the error to locate the producer emitting the wrong type
4. Use a comma-ok check at custom call sites and skip invalid rows

Example fix

// before
err := rbacRenderer.Render(render.PolicyRes{Resource: "pods"}, ns, row)
// after
err := rbacRenderer.Render(&render.PolicyRes{Resource: "pods"}, ns, row)

// gate before invoking the rbac renderer
if _, ok := o.(*render.PolicyRes); !ok {
	return fmt.Errorf("rbac view requires *render.PolicyRes, got %T", o)
}
err := rbacRenderer.Render(o, ns, row)

func isPolicyRes(o any) bool {
	_, ok := o.(*render.PolicyRes)
	return ok
}

if err := rbacRenderer.Render(o, ns, row); err != nil {
	slog.Warn("rbac row skipped", "type", fmt.Sprintf("%T", o), slogs.Error, err)
	return nil // drop the row, keep the view alive
}

When it happens

Trigger: Calling Rbac{}.Render with render.PolicyRes (a value, missing &) instead of *render.PolicyRes; feeding pods or unstructured resources into the RBAC view; a custom view reusing the Rbac renderer for non-policy rows.

Common situations: Extending the RBAC views or writing plugins that aggregate authorizations; refactoring the policy collector so it emits PolicyRes values instead of pointers; test fixtures constructed as values.

Related errors

• expected Unstructured, but got %T
• expected Unstructured, but got %T
• expected Unstructured, but got %T
• expected SubjectRes, but got %T
• expecting a ForwardRes but got %T

AI-assisted analysis of derailed/k9s@2d3ccc6ba2 (2026-08-15). Data as JSON: /api/errors/77eeb96b40c72098. Report an issue: GitHub.