rancher/rancher · error

failed to retrieve AzureADConfig, cannot read k8s Unstructur

Error message

failed to retrieve AzureADConfig, cannot read k8s Unstructured data

What it means

The object returned by Retriever.Get failed the runtime.Unstructured type assertion (azure_provider.go:456): the getter returned a typed object where unstructured content is required. Production wiring uses the wrangler unstructured client, so this appears with custom Retrievers (tests) or a changed wrangler client type.

Source

Thrown at pkg/auth/providers/azure/azure_provider.go:456

	config.ApplicationSecret = name

	logrus.Debugf("updating AzureADConfig")
	_, err = ap.authConfigs.ObjectClient().Update(config.Name, config)
	if err != nil {
		return err
	}
	return nil
}

func (ap *Provider) GetAzureConfigK8s() (*apiv3.AzureADConfig, error) {
	authConfigObj, err := ap.Retriever.Get(Name, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve AzureADConfig, error: %v", err)
	}

	u, ok := authConfigObj.(runtime.Unstructured)
	if !ok {
		return nil, fmt.Errorf("failed to retrieve AzureADConfig, cannot read k8s Unstructured data")
	}
	storedAzureADConfigMap := u.UnstructuredContent()

	storedAzureADConfig := &apiv3.AzureADConfig{}
	err = common.Decode(storedAzureADConfigMap, storedAzureADConfig)
	if err != nil {
		return nil, fmt.Errorf("unable to decode Azure Config: %w", err)
	}

	if storedAzureADConfig.ApplicationSecret != "" {
		value, err := common.ReadFromSecret(ap.secrets, storedAzureADConfig.ApplicationSecret,
			strings.ToLower(client.AzureADConfigFieldApplicationSecret))
		if err != nil {
			return nil, err
		}
		storedAzureADConfig.ApplicationSecret = value
	}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Return *unstructured.Unstructured from stub Retriever implementations
2. Wire Retriever through mgmtCtx.Management.AuthConfigs("").ObjectClient().UnstructuredClient() as Configure does
3. Keep the wrangler version consistent with the provider build

func isUnstructured(obj runtime.Object) bool {
	_, ok := obj.(runtime.Unstructured)
	return ok
}

When it happens

Trigger: A test or fork injects a Retriever whose Get returns *v3.AuthConfig or another typed runtime.Object instead of *unstructured.Unstructured.

Common situations: Unit tests with fake getters; forks replacing the unstructured client.

Related errors

• failed to retrieve ActiveDirectoryConfig, cannot read k8s Un
• invalid value for minMemorySize query param
• InvalidType
• invalid data for auth store update
• error creating secret %s: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/7be8827a8f843363. Report an issue: GitHub.