error rendering files: cluster %s/%s was not authorized to a

Error message

error rendering files: cluster %s/%s was not authorized to access secret %s/%s

What it means

Secrets delivered through machineSelectorFiles are gated by the annotation rke.cattle.io/object-authorized-for-clusters, a comma-separated list of cluster names; clusterObjectAuthorized splits on ',' and requires the cluster's name to appear as an element. If the annotation is absent or lists only other clusters, plan rendering aborts with this error. Note this is a different annotation than the single-value v2prov-secret-authorized-for-cluster used for cloud-provider secrets.

Source

Thrown at pkg/capr/planner/config.go:820

					for _, v := range fs.Secret.Items {
						file := plan.File{
							Path:    v.Path,
							Content: base64.StdEncoding.EncodeToString(secret.Data[v.Key]),
							Dynamic: v.Dynamic,
						}
						hash := sha256.Sum256(secret.Data[v.Key])
						if v.Hash != "" && v.Hash != base64.StdEncoding.EncodeToString(hash[:]) {
							return files, fmt.Errorf("secret %s does not contain the expected content", secret.Name)
						}
						if v.Permissions != "" {
							file.Permissions = v.Permissions
						} else if fs.Secret.DefaultPermissions != "" {
							file.Permissions = fs.Secret.DefaultPermissions
						}
						files = append(files, file)
					}
				} else {
					return files, fmt.Errorf("error rendering files: cluster %s/%s was not authorized to access secret %s/%s", controlPlane.Namespace, controlPlane.Name, controlPlane.Namespace, fs.Secret.Name)
				}
			}
			if fs.ConfigMap.Name != "" {
				configmap, err := p.configMapCache.Get(controlPlane.Namespace, fs.ConfigMap.Name)
				if err != nil {
					return files, fmt.Errorf("error retrieving configmap %s/%s while rendering files: %v", controlPlane.Namespace, fs.ConfigMap.Name, err)
				}
				// retrieve configmap and use contents
				if authorized, found := clusterObjectAuthorized(configmap, capr.AuthorizedObjectAnnotation, controlPlane.Name); authorized && found {
					for _, v := range fs.ConfigMap.Items {
						file := plan.File{
							Path:    v.Path,
							Content: base64.StdEncoding.EncodeToString([]byte(configmap.Data[v.Key])),
							Dynamic: v.Dynamic,
						}
						hash := sha256.Sum256([]byte(configmap.Data[v.Key]))
						if v.Hash != "" && v.Hash != base64.StdEncoding.EncodeToString(hash[:]) {
							return files, fmt.Errorf("configmap %s does not contain the expected content", configmap.Name)

View on GitHub (pinned to 932558d4e6)

Solutions

Annotate the secret with the cluster: kubectl annotate secret <name> -n <ns> rke.cattle.io/object-authorized-for-clusters=<cluster-name>
For shared secrets, list all consuming clusters comma-separated with no extra spaces
Let Rancher's file-secret flow manage the annotation when possible
Verify with kubectl get secret <name> -o jsonpath='{.metadata.annotations}'

Example fix

# before
kubectl create secret generic my-files -n fleet-default --from-file=hosts=./hosts
# cluster spec fileSources references it -> not authorized

# after
kubectl create secret generic my-files -n fleet-default --from-file=hosts=./hosts
kubectl annotate secret my-files -n fleet-default rke.cattle.io/object-authorized-for-clusters=my-cluster

Defensive patterns

Strategy: validation

Validate before calling

func authorizedForObject(o metav1.Object, cluster string) bool {
	for _, c := range strings.Split(o.GetAnnotations()["rke.cattle.io/object-authorized-for-clusters"], ",") {
		if c == cluster {
			return true
		}
	}
	return false
}

// call before referencing the secret in fileSources

Prevention

Annotate file-source secrets with rke.cattle.io/object-authorized-for-clusters at creation time
When sharing, list every consuming cluster comma-separated without spaces
Include the annotation in the same GitOps manifest as the secret
Remember this is a different annotation than the cloud-provider v2prov one

When it happens

Trigger: Referencing a secret in fileSources when the secret has no rke.cattle.io/object-authorized-for-clusters annotation, or the annotation value omits this cluster's name (including whitespace or trailing-comma mismatches after splitting).

Common situations: Manually created file secrets; sharing one secret across several clusters without listing all of them; GitOps pipelines that create secrets but not the authorization annotation.

Related errors

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/bf88f7432e703e55. Report an issue: GitHub.