{"record":{"id":"0a1033e0a8b899b3","repo":"argoproj/argo-workflows","slug":"failed-to-get-a-kerberos-client","errorCode":null,"errorMessage":"failed to get a kerberos client","messagePattern":"failed to get a kerberos client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/hdfs/util.go","lineNumber":57,"sourceCode":"\t\tif cacheErr != nil {\n\t\t\treturn nil, cacheErr\n\t\t}\n\t\treturn client, nil\n\t} else if krbOptions.KeytabOptions != nil {\n\t\tclient := krb.NewWithKeytab(\n\t\t\tkrbOptions.KeytabOptions.Username,\n\t\t\tkrbOptions.KeytabOptions.Realm,\n\t\t\t&krbOptions.KeytabOptions.Keytab,\n\t\t\tkrbConfig,\n\t\t)\n\t\terr = client.Login()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn client, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"failed to get a kerberos client\")\n}\n","sourceCodeStart":39,"sourceCodeEnd":59,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/hdfs/util.go#L39-L59","documentation":"createKrbClient builds a Kerberos client for HDFS access from either a credential cache or a keytab. If the KrbOptions contain neither CCacheOptions nor KeytabOptions, it falls through to this generic error. It means the Kerberos configuration was recognized but carried no usable credential source.","triggerScenarios":"Configuring HDFS artifact access with kerberos enabled (hdfsArtifact with krbOptions) but providing only krbcfg (config string) or servicePrincipalName while omitting both the ccache and keytab material; createHDFSClient then returns this error before any connection attempt.","commonSituations":"Misconfigured argo worklfow controller ConfigMap where users set `keytab`/`ccache` data in the wrong field or forget to mount the keytab secret; partially copied sample configs that only include the krb5.conf section.","solutions":["Provide keytabOptions (username, realm, keytab bytes) in the HDFS artifact krbOptions of the controller ConfigMap.","Alternatively supply ccacheOptions with a valid Kerberos credential cache.","Verify the keytab secret is mounted and its contents are base64-loaded into the ConfigMap correctly.","Check createKrbClient in workflow/artifacts/hdfs/util.go to confirm which branch (CCache/Keytab) your config is expected to hit."],"exampleFix":"// before\nhdfsArtifacts:\n  - krbOptions:\n      krbcfg: \"...\"\n// after\nhdfsArtifacts:\n  - krbOptions:\n      krbcfg: \"...\"\n      keytabOptions:\n        username: hdfs-user\n        realm: EXAMPLE.COM\n        keytab: <base64 keytab>","handlingStrategy":"validation","validationCode":"func validateKrbOptions(o *KrbOptions) error {\n\tif o == nil {\n\t\treturn nil\n\t}\n\tif o.CCacheOptions == nil && o.KeytabOptions == nil {\n\t\treturn fmt.Errorf(\"krbOptions needs either ccacheOptions or keytabOptions\")\n\t}\n\treturn nil\n}","typeGuard":"func hasKrbCredentialSource(o *KrbOptions) bool {\n\treturn o != nil && (o.CCacheOptions != nil || o.KeytabOptions != nil)\n}","tryCatchPattern":"cli, err := createHDFSClient(addrs, user, prot, krbOpts)\nif err != nil && strings.Contains(err.Error(), \"failed to get a kerberos client\") {\n\t// config omits ccache/keytab: surface a config error to the operator\n}","preventionTips":["Always pair kerberos config with keytab (preferred) or a valid ccache","Mount keytab secrets and verify base64 encoding before deploying","Lint the controller ConfigMap for complete hdfsArtifacts krbOptions","Test HDFS artifact access with a canary workflow after config changes"],"tags":["hdfs","kerberos","configuration","authentication"],"backgroundTag":"missing-kerberos-credentials","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}