kubesphere/kubesphere · warning

cannot obtain user info

Error message

cannot obtain user info

What it means

listWorkloadTemplate needs the authenticated user to filter secrets (workload templates) by workspace permissions via FilterByPermissions. If request.UserFrom finds no user in the context, the handler responds 403 Forbidden with 'cannot obtain user info'.

Source

Thrown at pkg/kapis/workloadtemplate/v1alpha1/handler.go:68

	}
	namespace := req.PathParameter("namespace")
	if namespace != "" {
		opts = append(opts, client.InNamespace(namespace))
	}
	err := h.client.List(req.Request.Context(), &secretList, opts...)
	if err != nil {
		api.HandleError(resp, req, err)
		return
	}
	workspace := req.PathParameter("workspace")
	if workspace == "" {
		resp.WriteEntity(k8suitl.ConvertToListResult(&secretList, req))
		return
	}

	user, ok := request.UserFrom(req.Request.Context())
	if !ok {
		err := fmt.Errorf("cannot obtain user info")
		klog.Errorln(err)
		api.HandleForbidden(resp, nil, err)
		return
	}

	filteredList, err := h.FilterByPermissions(workspace, user, secretList)
	if err != nil {
		api.HandleError(resp, req, err)
		return
	}

	resp.WriteEntity(k8suitl.ConvertToListResult(filteredList, req))
}

func (h *templateHandler) FilterByPermissions(workspace string, user user.Info, secretList corev1.SecretList) (*corev1.SecretList, error) {

	listNS := authorizer.AttributesRecord{
		User:            user,

View on GitHub (pinned to 04a29b5c60)

Solutions

1. Include a valid bearer token when listing workload templates.
2. In tests, wrap the request context with request.WithUser to supply a user.Info.
3. Confirm ks-apiserver's authentication filter chain handles the workloadtemplate routes.
4. Check token validity/expiry and re-login if needed.

Example fix

// before (test)
req := restful.NewRequest(http.NewRequest("GET", "/workloadtemplates", nil))
// after
ctx := request.WithUser(r.Context(), &user.DefaultInfo{Name: "admin", Groups: []string{"system"}})
r = r.WithContext(ctx)
req := restful.NewRequest(r)

// ensure user info exists before invoking handler in tests
ctx := request.WithUser(r.Context(), &user.DefaultInfo{Name: "admin"})
r = r.WithContext(ctx)

When it happens

Trigger: Listing workload templates (secrets of type workload template) without a principal in the request context, e.g. unauthenticated API calls or tests invoking the handler directly on a bare context.

Common situations: Calling the workloadtemplate API without a token; integration tests that construct restful.Request without running authn filters; proxies stripping credentials.

Related errors

• unable to create issuer: %v
• cannot obtain user info
• not allow to get users
• cannot obtain user info
• cannot obtain user info

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/b023d191215de940. Report an issue: GitHub.