rancher/rancher · error

failed to create UserAttribute: %w

Error message

failed to create UserAttribute: %w

What it means

During login, Rancher persists per-user group/extra info in a UserAttribute CR. This error fires when the initial Create of that CR fails. The wrapped error is the Kubernetes API cause.

Source

Thrown at pkg/auth/providers/common/usermanager.go:408

	}

	if m.userAttributeChanged(attribs, provider, userExtraInfo, groupPrincipals) {
		shouldUpdate = true
	}
	if len(loginTime) > 0 && !loginTime[0].IsZero() {
		// Login time is truncated to seconds as the corresponding user label is set as epoch time.
		lastLogin := metav1.NewTime(loginTime[0].Truncate(time.Second))
		attribs.LastLogin = &lastLogin
		shouldUpdate = true
	}

	attribs.GroupPrincipals[provider] = v3.Principals{Items: groupPrincipals}
	attribs.ExtraByProvider[provider] = userExtraInfo

	if needCreate {
		_, err = m.userAttributes.Create(attribs)
		if err != nil {
			return fmt.Errorf("failed to create UserAttribute: %w", err)
		}

		return nil
	}

	if shouldUpdate {
		_, err = m.userAttributes.Update(attribs)
		if err != nil {
			return fmt.Errorf("failed to update UserAttribute: %w", err)
		}
	}

	return nil
}

func (m *userManager) userAttributeChanged(attribs *v3.UserAttribute, provider string, extraInfo map[string][]string, groupPrincipals []v3.Principal) bool {
	if len(attribs.GroupPrincipals[provider].Items) != len(groupPrincipals) {
		return true

View on GitHub (pinned to 932558d4e6)

Solutions

1. Read the wrapped error: NotFound -> CRD missing, Forbidden -> RBAC, AlreadyExists -> race
2. Ensure the UserAttribute CRD exists (re-apply rancher CRDs)
3. Grant create on userattributes.management.cattle.io to the service account
4. On AlreadyExists races, re-fetch the attribute and fall through to the update path

// Check the CRD is established before enabling a provider that writes UserAttributes
_, err := apiExt.ApiextensionsV1().CustomResourceDefinitions().Get(ctx, "userattributes.management.cattle.io", metav1.GetOptions{})
if err != nil { return fmt.Errorf("UserAttribute CRD missing: %w", err) }

if err := m.saveUserAttributes(...); err != nil {
    if apierrors.IsAlreadyExists(errors.Unwrap(err)) {
        // concurrent login created it: fall through to update path
        needCreate = false
        return updatePath()
    }
    return err
}

When it happens

Trigger: m.userAttributes.Create fails: CRD management.cattle.io/v3 UserAttribute not installed/removed, RBAC create denial, or an AlreadyExists race when two logins race to create the same UserAttribute.

Common situations: First login after upgrade before CRDs reconcile; clusters where rancher CRDs were pruned; concurrent logins of the same user from two sessions.

Related errors

• failed to update UserAttribute: %w
• error getting secret for %s : %w
• error getting secret %s: %w
• impersonating webhook to update principal: %w
• listing users for search %q: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/ca49000b8c45c8f4. Report an issue: GitHub.