{"record":{"id":"07fb3ef262f30619","repo":"argoproj/argo-workflows","slug":"failed-to-check-if-bucket-s-exists-w","errorCode":null,"errorMessage":"failed to check if bucket %s exists: %w","messagePattern":"failed to check if bucket (.+?) exists: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/oss/oss.go","lineNumber":241,"sourceCode":"\t\t\tlogger.Info(ctx, \"OSS Save\")\n\t\t\tosscli, err := ossDriver.newOSSClient(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t}\n\t\t\tisDir, err := file.IsDirectory(path)\n\t\t\tif err != nil {\n\t\t\t\tlogger.WithError(err).Warn(ctx, \"Failed to test if path is a directory\")\n\t\t\t\treturn false, nil\n\t\t\t}\n\t\t\tbucketName := outputArtifact.OSS.Bucket\n\t\t\terr = setBucketLogging(osscli, bucketName)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t}\n\t\t\tif outputArtifact.OSS.CreateBucketIfNotPresent {\n\t\t\t\texists, existsErr := osscli.IsBucketExist(bucketName)\n\t\t\t\tif existsErr != nil {\n\t\t\t\t\treturn !isTransientOSSErr(ctx, existsErr), fmt.Errorf(\"failed to check if bucket %s exists: %w\", bucketName, existsErr)\n\t\t\t\t}\n\t\t\t\tif !exists {\n\t\t\t\t\terr = osscli.CreateBucket(bucketName)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn !isTransientOSSErr(ctx, err), fmt.Errorf(\"failed to automatically create bucket %s when it's not present: %w\", bucketName, err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tbucket, err := osscli.Bucket(bucketName)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t}\n\t\t\tobjectName := outputArtifact.OSS.Key\n\t\t\tif outputArtifact.OSS.LifecycleRule != nil {\n\t\t\t\terr = setBucketLifecycleRule(osscli, outputArtifact.OSS)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t\t}","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/oss/oss.go#L223-L259","documentation":"Raised in Save when outputArtifact.OSS.CreateBucketIfNotPresent is true and the IsBucketExist probe fails. This is an API/transport error while checking bucket existence, not a 'bucket missing' result — usually credentials, endpoint, or permission problems. Non-transient errors abort the Save backoff immediately.","triggerScenarios":"Saving an output artifact with createBucketIfNotPresent: true while osscli.IsBucketExist errors: invalid AK/SK, unreachable or wrong endpoint, missing oss:GetBucketInfo/List permission on the account, or DNS/network failure from the exec to OSS.","commonSituations":"First-time setup where the secret's endpoint is wrong (e.g. internal endpoint from outside the VPC); RAM user lacking bucket-level read permissions; typo'd bucket name violating OSS naming rules can also surface here depending on SDK validation; corporate proxy blocking the OSS endpoint.","solutions":["Check the wrapped OSS error code to distinguish AccessDenied (fix RAM policy: add oss:GetBucketInfo/oss:ListObjects) from network errors (fix endpoint/DNS).","Verify endpoint and credentials in the artifact repository secret; test with ossutil using the same AK/SK/endpoint.","If you pre-create the bucket yourself, set createBucketIfNotPresent: false to skip the existence probe entirely.","If transient (network/throttle), re-run — the driver's backoff already retries transient errors."],"exampleFix":"// before (workflow spec)\noss:\n  createBucketIfNotPresent: true\n// after (bucket managed externally, avoids the probe)\noss:\n  createBucketIfNotPresent: false","handlingStrategy":"validation","validationCode":"// preflight outside the workflow, same credentials\ncli, err := oss.New(endpoint, ak, sk)\nif err != nil { panic(err) }\nok, err := cli.IsBucketExist(bucketName)\nif err != nil { panic(fmt.Sprintf(\"bucket probe failed (creds/endpoint/permission): %v\", err)) }\nfmt.Printf(\"bucket %s exists: %v\\n\", bucketName, ok)","typeGuard":"func isBucketProbeErr(err error) bool {\n\tse, ok := err.(oss.ServiceError)\n\treturn ok && (se.Code == \"AccessDenied\" || se.Code == \"SignatureDoesNotMatch\" || se.StatusCode == 403)\n}","tryCatchPattern":"err := driver.Save(ctx, path, artifact)\nif err != nil && strings.Contains(err.Error(), \"failed to check if bucket\") {\n\tvar se oss.ServiceError\n\tif errors.As(err, &se) && se.StatusCode == 403 {\n\t\t// credentials/permission problem: alert, don't retry\n\t}\n}","preventionTips":["Keep createBucketIfNotPresent: false in production; manage buckets via IaC.","Preflight credentials with ossutil (ossutil ls) using the exact secret values.","Scope RAM policies to include bucket-level read actions if the probe stays enabled.","Document env/secret setup so endpoints match the pod network (internal vs public endpoint)."],"tags":["oss","bucket","permissions","artifact-upload"],"backgroundTag":"oss-access-denied","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}