rancher/rancher · error

unable to decode Google Oauth Config: %w

Error message

unable to decode Google Oauth Config: %w

What it means

common.Decode failed while converting the AuthConfig CR's unstructured map into a typed apiv3.GoogleOauthConfig. This means the CR exists and was fetched, but its stored fields do not match the expected schema — wrong field types, unknown/renamed fields, or values that cannot be unmarshalled into the typed struct. The underlying decode error is chained with %w.

Source

Thrown at pkg/auth/providers/googleoauth/goauth_provider.go:327

	}
	return allowed, nil
}

func (g *googleOauthProvider) getGoogleOAuthConfigCR() (*apiv3.GoogleOauthConfig, error) {
	authConfigObj, err := g.authConfigs.ObjectClient().UnstructuredClient().Get(Name, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve GoogleOAuthConfig, error: %v", err)
	}
	u, ok := authConfigObj.(runtime.Unstructured)
	if !ok {
		return nil, fmt.Errorf("failed to retrieve GoogleOAuthConfig, cannot read k8s Unstructured data")
	}
	storedGoogleOAuthConfigMap := u.UnstructuredContent()

	storedGoogleOAuthConfig := &apiv3.GoogleOauthConfig{}
	err = common.Decode(storedGoogleOAuthConfigMap, storedGoogleOAuthConfig)
	if err != nil {
		return nil, fmt.Errorf("unable to decode Google Oauth Config: %w", err)
	}

	if storedGoogleOAuthConfig.OauthCredential != "" {
		value, err := common.ReadFromSecret(g.secrets, storedGoogleOAuthConfig.OauthCredential, strings.ToLower(client.GoogleOauthConfigFieldOauthCredential))
		if err != nil {
			return nil, err
		}
		storedGoogleOAuthConfig.OauthCredential = value
	}

	if storedGoogleOAuthConfig.ServiceAccountCredential != "" {
		value, err := common.ReadFromSecret(g.secrets, storedGoogleOAuthConfig.ServiceAccountCredential, strings.ToLower(client.GoogleOauthConfigFieldServiceAccountCredential))
		if err != nil {
			return nil, err
		}
		storedGoogleOAuthConfig.ServiceAccountCredential = value
	}
	return storedGoogleOAuthConfig, nil

View on GitHub (pinned to 932558d4e6)

Solutions

1. Read the chained error — it names the exact field and reason (e.g. cannot unmarshal string into bool)
2. kubectl get authconfigs googleoauth -o yaml and fix or remove the offending field
3. If schema drift from an upgrade, disable/re-enable Google OAuth via testAndApply to rewrite the CR cleanly
4. Keep AuthConfig CRs out of untested GitOps pipelines or validate them against the current CRD

Example fix

# before (bad field type in CR)
spec:
  accessMode: "unrestricted"   # plus a stray numeric field like minuxSeconds: "abc"

# after: delete bad fields and re-apply
kubectl patch authconfigs googleoauth --type=merge -p '{"spec":{"minuxSeconds":null}}'

// yaml decodes and round-trips the CR to catch schema mismatches before use:
// kubectl apply --dry-run=server -f googleoauth-authconfig.yaml
# any field rejected by the CRD here would otherwise surface as the decode error later

err := common.Decode(storedGoogleOAuthConfigMap, storedGoogleOAuthConfig)
if err != nil {
    return nil, fmt.Errorf("GoogleOAuthConfig CR is malformed (%w); run 'kubectl get authconfigs googleoauth -o yaml' and fix or delete the bad fields", err)
}

When it happens

Trigger: Someone hand-edited kubectl edit authconfigs googleoauth and introduced a type mismatch (e.g. strings where the schema expects booleans or numbers); a CR written by an older/newer Rancher version with a schema drift; applying a YAML manifest with indented or quoted values that decode differently.

Common situations: GitOps-managed AuthConfig CRs drifting from the schema; Rancher upgrade where GoogleOauthConfig fields changed; manual kubectl edits; CRs restored from a different cluster/version backup.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to retrieve GoogleOAuthConfig, error: %v
• failed to retrieve GoogleOAuthConfig, cannot read k8s Unstru
• invalid value for minMemorySize query param
• InvalidType
• failed to find schema ${apiContext.Type}

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/a2af19bce1c05d7c. Report an issue: GitHub.