{"record":{"id":"0cfe82a4a2783f49","repo":"argoproj/argo-workflows","slug":"failed-to-create-agent-pod-w","errorCode":null,"errorMessage":"failed to create Agent pod: %w","messagePattern":"failed to create Agent pod: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/agent.go","lineNumber":290,"sourceCode":"\t\t\t// The rate limiter runs before Create, so on the rate-limited path\n\t\t\t// the AlreadyExists→Get recovery inside createPodFromBuild never\n\t\t\t// runs. A pod created by a prior reconcile that has not yet reached\n\t\t\t// the informer (checked at the top of this function) must be\n\t\t\t// recovered with a direct Get rather than requeued as though no pod\n\t\t\t// existed.\n\t\t\tif errors.Is(err, ErrResourceRateLimitReached) {\n\t\t\t\tif existing, getErr := woc.getPod(ctx, podName); getErr == nil {\n\t\t\t\t\tlog.Info(ctx, \"Recovered existing Agent pod on rate-limited create\")\n\t\t\t\t\treturn existing, nil\n\t\t\t\t}\n\t\t\t}\n\t\t\twoc.requeue()\n\t\t\treturn nil, nil\n\t\t}\n\t\t// createPodFromBuild wraps non-transient failures generically; add the\n\t\t// agent-pod context so an agent-pod creation failure is distinguishable\n\t\t// from a workload-pod one in logs/status.\n\t\treturn nil, fmt.Errorf(\"failed to create Agent pod: %w\", err)\n\t}\n\tlog.Info(ctx, \"Created Agent pod\")\n\treturn created, nil\n}\n\nfunc (woc *wfOperationCtx) getExecutorPlugins(ctx context.Context) ([]apiv1.Container, []apiv1.Volume, error) {\n\tvar sidecars []apiv1.Container\n\tvar volumes []apiv1.Volume\n\tnamespaces := map[string]bool{} // de-dupes executorPlugins when their namespaces are the same\n\tnamespaces[woc.controller.namespace] = true\n\tnamespaces[woc.wf.Namespace] = true\n\twFPlugins, err := woc.execWf.Spec.AsExecutorPluginSpec()\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tisGetPluginsFromWorkflow := len(wFPlugins) > 0\n\tif isGetPluginsFromWorkflow && !woc.controller.enableWorkflowLevelExecutorPlugins {\n\t\treturn nil, nil, fmt.Errorf(","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/agent.go#L272-L308","documentation":"After building the Agent pod spec, createAgentPod asks the controller to create it (via createPodFromBuild). When pod creation fails and the failure is not a transient requeue case, the error is wrapped as 'failed to create Agent pod: %w' so agent-pod creation failures are distinguishable from workload-pod failures in logs/status.","triggerScenarios":"The k8s pod Create call fails during reconcileAgentPod: invalid pod spec (e.g. plugin container misconfiguration), quota exceeded, admission webhook rejection, API server error, or duplicate pod name race (already exists but not found in informer store yet).","commonSituations":"ResourceQuota in the namespace blocks pod creation; a mutating admission webhook (e.g. Istio sidecar injection policy, Kyverno) rejects the agent pod spec; API version incompatibilities from CRDs/validating webhooks; namespace terminating while workflow still running.","solutions":["Read the wrapped inner error for the exact API reason (quota, webhook denial, invalid spec)","Check namespace ResourceQuota/LimitRange: `kubectl describe resourcequota -n <ns>`","Inspect admission webhook rejections in the error and adjust webhook policy or plugin spec","Retry the workflow if the cause was transient (API blip, race with informer store)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"kubectl describe resourcequota -n <workflow-namespace>  # and check admission webhooks","typeGuard":null,"tryCatchPattern":"created, err := createAgentPod(ctx)\nif err != nil {\n    if util.errors.IsTransientErr(ctx, err) { woc.requeue(); return }\n    return fmt.Errorf(\"failed to create Agent pod: %w\", err)\n}","preventionTips":["Set ResourceQuota headroom for agent pods in workflow namespaces","Review mutating/validating webhooks (Istio, Kyverno) for exemptions needed by agent pods","Don't let namespaces terminate with active workflows"],"tags":["kubernetes","pod-creation","admission","argo-workflows"],"backgroundTag":"pod-creation-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}