{"record":{"id":"244334fabef45c69","repo":"argoproj/argo-workflows","slug":"w-244334","errorCode":null,"errorMessage":"%w","messagePattern":"%w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/argoexec/commands/resource.go","lineNumber":24,"sourceCode":"\n\t\"github.com/spf13/cobra\"\n\n\t\"github.com/argoproj/argo-workflows/v4/util/logging\"\n\t\"github.com/argoproj/argo-workflows/v4/workflow/common\"\n\n\t\"github.com/argoproj/argo-workflows/v4/cmd/argoexec/executor\"\n\t\"github.com/argoproj/argo-workflows/v4/workflow/executor/tracing\"\n)\n\nfunc NewResourceCommand() *cobra.Command {\n\tcommand := cobra.Command{\n\t\tUse:   \"resource (get|create|apply|delete) MANIFEST\",\n\t\tShort: \"update a resource and wait for resource conditions\",\n\t\tArgs:  cobra.ExactArgs(1),\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\terr := execResource(cmd.Context(), args[0])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"%w\", err)\n\t\t\t}\n\t\t\treturn nil\n\t\t},\n\t}\n\treturn &command\n}\n\n//nolint:contextcheck\nfunc execResource(ctx context.Context, action string) error {\n\tctx = tracing.InjectTraceContext(ctx)\n\twfExecutor := executor.Init(ctx, clientConfig, varRunArgo)\n\tdefer func() {\n\t\tif err := wfExecutor.Tracing.Shutdown(context.WithoutCancel(ctx)); err != nil {\n\t\t\tlogging.RequireLoggerFromContext(ctx).WithError(err).Error(ctx, \"Failed to shutdown tracing\")\n\t\t}\n\t}()\n\n\t// Don't allow cancellation to impact capture of results, parameters, artifacts, or defers.","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/cmd/argoexec/commands/resource.go#L6-L42","documentation":"The `argoexec resource` cobra command wraps any error from execResource with fmt.Errorf(\"%w\", err). It is a transparent wrapper adding no message text; the underlying cause (a kubectl apply/get/delete failure on the managed resource) is preserved via %w. The real error comes from applying or waiting on a Kubernetes resource manifest in the resource template.","triggerScenarios":"Running `argoexec resource <verb> <manifest>` where execResource fails — kubectl-style apply fails due to invalid manifest YAML, RBAC denial for the workflow service account, API server unreachable, or a waited-for condition never becomes true.","commonSituations":"Resource templates whose manifests reference CRDs not installed on the cluster; missing RBAC permissions for the pod's service account; wrong apiVersion in the manifest; cluster API server transiently unavailable.","solutions":["Inspect the wrapped underlying error for the concrete k8s API failure","Validate the manifest locally with `kubectl apply --dry-run=client`","Grant the workflow service account RBAC rules for the resource kinds being managed","Confirm the target CRD/API version exists on the cluster"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-validate the manifest outside the workflow:\n// kubectl apply --dry-run=client -f manifest.yaml\n// kubectl auth can-i create <resource> --as=system:serviceaccount:ns:wf-sa","typeGuard":null,"tryCatchPattern":"// unwrap to classify the k8s API error\nerr := execResource(ctx, manifest)\nif err != nil {\n    var se *apierrors.StatusError\n    if errors.As(err, &se) {\n        // inspect se.ErrStatus.Reason: Forbidden / NotFound / Invalid\n    }\n}","preventionTips":["Dry-run resource manifests before embedding them in workflows","Provision RBAC for the workflow service account covering managed kinds","Pin apiVersions that exist on the target cluster","Test CRD availability before deploying resource templates"],"tags":["go","cobra","argo-executor","kubernetes","resource-template"],"backgroundTag":"error-wrapping-passthrough","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}