rancher/rancher · error

failed to retrieve GithubConfig, error: %v

Error message

failed to retrieve GithubConfig, error: %v

What it means

Provider.getGithubConfigCR fails to GET the GithubConfig custom resource from the management cluster via the unstructured object client. This is a Kubernetes API-level failure: most often NotFound because the CR does not exist yet, but also RBAC denials, timeouts, or an unreachable API server.

Source

Thrown at pkg/auth/providers/github/github_provider.go:92

func (g *Provider) GetName() string {
	return Name
}

func (g *Provider) CustomizeSchema(schema *types.Schema) {
	schema.ActionHandler = g.actionHandler
	schema.Formatter = g.formatter
}

func (g *Provider) TransformToAuthProvider(authConfig map[string]any) (map[string]any, error) {
	p := common.TransformToAuthProvider(authConfig)
	p[publicclient.GithubProviderFieldRedirectURL] = formGithubRedirectURLFromMap(authConfig)
	return p, nil
}

func (g *Provider) getGithubConfigCR() (*apiv3.GithubConfig, error) {
	authConfigObj, err := g.authConfigs.ObjectClient().UnstructuredClient().Get(Name, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve GithubConfig, error: %v", err)
	}
	u, ok := authConfigObj.(runtime.Unstructured)
	if !ok {
		return nil, fmt.Errorf("failed to retrieve GithubConfig, cannot read k8s Unstructured data")
	}
	storedGithubConfigMap := u.UnstructuredContent()

	storedGithubConfig := &apiv3.GithubConfig{}
	err = common.Decode(storedGithubConfigMap, storedGithubConfig)
	if err != nil {
		return nil, fmt.Errorf("unable to decode Github Config: %w", err)
	}

	if storedGithubConfig.ClientSecret != "" {
		data, err := common.ReadFromSecretData(g.secrets, storedGithubConfig.ClientSecret)
		if err != nil {
			return nil, err
		}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Run: kubectl get authconfigs -A (or GithubConfig CR) and confirm an object named 'github' exists in the expected namespace.
2. Check controller pod logs/rbac: kubectl auth can-i get authconfigs --as=system:serviceaccount:<ns>:<sa>.
3. If the CR was deleted, recreate it via the auth provider UI/API so it is written back.
4. Retry once after a short delay if this hit during an upgrade window.

// pre-flight: does the CR exist and is it gettable?
_, err := dynamicClient.Resource(gvr).Namespace(ns).Get(ctx, "github", metav1.GetOptions{})
if apierrors.IsNotFound(err) {
    return errors.New("GithubConfig CR not found — enable/configure the GitHub auth provider first")
}
if err != nil {
    return fmt.Errorf("checking GithubConfig: %w", err)
}

cfg, err := g.getGithubConfigCR()
if err != nil {
    if apierrors.IsNotFound(errors.Unwrap(err)) {
        // provider not configured: degrade gracefully, prompt setup
        return handleUnconfiguredProvider()
    }
    return err // RBAC / API server issues: surface for operators
}

When it happens

Trigger: Applying/deleting the GithubConfig CR while a login or search is in flight; Rancher bootstrapping before the CR is created; the management-cluster service account lacking get on authconfigs; API server connection issues from the pod.

Common situations: Fresh installs where GitHub auth was enabled but the CR name is not exactly 'github'; helm upgrades that briefly remove the CR; kubectl apply of auth config with a wrong name/namespace; tightened PSA/RBAC blocking cattle controllers.

Related errors

• error creating secret %s: %w
• error getting secret for %s : %w
• error updating secret %s: %w
• error creating secret %s %w
• impersonating webhook to update principal: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/39c00fedc01c4a73. Report an issue: GitHub.