{"record":{"id":"01b296d130cd73fa","repo":"argoproj/argo-workflows","slug":"failed-to-read-certificate-file-w","errorCode":null,"errorMessage":"failed to read certificate file: %w","messagePattern":"failed to read certificate file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":91,"sourceCode":"\nfunc ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {\n\tvar cert *x509.Certificate\n\tvar err error\n\tif len(restConfig.CertData) > 0 {\n\t\t// Decode certificate from memory data\n\t\tblock, _ := pem.Decode(restConfig.CertData)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t} else {\n\t\t// Load certificate from file\n\t\tdata, err := os.ReadFile(restConfig.CertFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read certificate file: %w\", err)\n\t\t}\n\t\tblock, _ := pem.Decode(data)\n\t\tif block == nil || block.Type != \"CERTIFICATE\" {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate PEM\")\n\t\t}\n\t\tcert, err = x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse certificate: %w\", err)\n\t\t}\n\t}\n\n\tif cert == nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse certificate\")\n\t}\n\n\t// Extract username from CommonName (CN)\n\tusername := cert.Subject.CommonName\n","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L73-L109","documentation":"When the rest.Config has no inline CertData, ClaimSetWithX509 falls back to reading the certificate from restConfig.CertFile with os.ReadFile. If the file cannot be opened (missing, unreadable, wrong path), the OS error is wrapped as 'failed to read certificate file: %w'. The operation aborts because no identity claims can be derived without the certificate.","triggerScenarios":"restConfig.CertData is empty, restConfig.CertFile points to a path that does not exist, is a directory, or the process lacks read permission, so os.ReadFile returns an error which is wrapped and returned.","commonSituations":"Mounted secret volume path changed or not mounted yet; client-certificate file deleted after kubeconfig was flattened; argo-server running with a different service account that cannot read the cert path; typo in certFile path in kubeconfig.","solutions":["Check the file exists and is readable: `ls -l <CertFile path>` and `head -1 <path>` should show '-----BEGIN CERTIFICATE-----'","Fix the kubeconfig's users[].user.client-certificate path or mount the client cert secret into the argo-server pod","If running in-cluster, provide inline CertData (base64 of the cert) instead of a file path so no filesystem dependency exists"],"exampleFix":"// before\nrestConfig.CertFile = \"/secrets/tls/client.crt\" // file not mounted\n// after: embed the data so no file read is needed\nrestConfig.CertData = clientCertPEMBytes","handlingStrategy":"validation","validationCode":"func validateCertFile(path string) error {\n    data, err := os.ReadFile(path)\n    if err != nil {\n        return fmt.Errorf(\"cert file %q unreadable: %w\", path, err)\n    }\n    return nil\n}\n// call before constructing rest.Config with CertFile","typeGuard":null,"tryCatchPattern":"claims, err := ClaimSetWithX509(restConfig)\nif err != nil && strings.Contains(err.Error(), \"failed to read certificate file\") {\n    // fall back or surface a config-fix message\n}","preventionTips":["Use absolute, stable paths for client certs (e.g. /var/run/secrets/... mounts)","Prefer inline CertData over CertFile in containers to avoid mount-order issues","Check secret volume mounts are ready before argo-server starts (init containers/dependsOn)","Test file readability as the same user/UID the server runs as"],"tags":["tls","filesystem","authentication","kubeconfig"],"backgroundTag":"certificate-file-not-found","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}