kubesphere/kubesphere · error

failed to list builtin role templates

Error message

failed to list builtin role templates

What it means

Reconciler.initRoles: listing BuiltinRole templates (iamv1beta1.BuiltinRoleList with the scope label selector) via r.List failed. Without the role templates the namespace's builtin roles cannot be materialized; the wrapped API error names the cause (RBAC, connectivity, or malformed cluster-scoped templates).

Source

Thrown at pkg/controller/namespace/namespace_controller.go:126

		}
		return ctrl.Result{}, nil
	}

	if !workspaceLabelExists {
		if err := r.cleanUp(ctx, namespace); err != nil {
			return ctrl.Result{}, errors.Wrapf(err, "failed to clean up namespace %s", namespace.Name)
		}
	}

	r.recorder.Event(namespace, corev1.EventTypeNormal, kscontroller.Synced, kscontroller.MessageResourceSynced)
	return ctrl.Result{}, nil
}

func (r *Reconciler) initRoles(ctx context.Context, namespace *corev1.Namespace) error {
	logger := klog.FromContext(ctx)
	var templates iamv1beta1.BuiltinRoleList
	if err := r.List(ctx, &templates, client.MatchingLabels{iamv1beta1.ScopeLabel: iamv1beta1.ScopeNamespace}); err != nil {
		return errors.Wrapf(err, "failed to list builtin role templates")
	}
	for _, template := range templates.Items {
		selector, err := metav1.LabelSelectorAsSelector(&template.TargetSelector)
		if err != nil {
			logger.V(4).Error(err, "failed to pares target selector", "template", template.Name)
			continue
		}
		if !selector.Matches(labels.Set(namespace.Labels)) {
			continue
		}
		var builtinRoleTemplate iamv1beta1.Role
		if err := yaml.NewYAMLOrJSONDecoder(bytes.NewBuffer(template.Role.Raw), 1024).Decode(&builtinRoleTemplate); err == nil &&
			builtinRoleTemplate.Kind == iamv1beta1.ResourceKindRole {
			existingRole := &iamv1beta1.Role{ObjectMeta: metav1.ObjectMeta{Name: builtinRoleTemplate.Name, Namespace: namespace.Name}}
			op, err := controllerutil.CreateOrUpdate(ctx, r.Client, existingRole, func() error {
				existingRole.Labels = builtinRoleTemplate.Labels
				existingRole.Annotations = builtinRoleTemplate.Annotations
				existingRole.AggregationRoleTemplates = builtinRoleTemplate.AggregationRoleTemplates

View on GitHub (pinned to 04a29b5c60)

Solutions

1. Confirm BuiltinRole CRD is installed and template objects exist with the scope label
2. Check controller RBAC for list permissions on the builtinroles resource
3. Fix the underlying list error shown in the wrapped message and let the controller re-reconcile

When it happens

Trigger: Thrown at pkg/controller/namespace/namespace_controller.go:126 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/ee630b9eeafd5515. Report an issue: GitHub.