{"record":{"id":"260441681372ffff","repo":"argoproj/argo-workflows","slug":"failed-to-configure-bucket-logging-w","errorCode":null,"errorMessage":"failed to configure bucket logging: %w","messagePattern":"failed to configure bucket logging: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"workflow/artifacts/oss/oss.go","lineNumber":356,"sourceCode":"\t\t\t\tfor _, object := range results.Objects {\n\t\t\t\t\tfiles = append(files, object.Key)\n\t\t\t\t}\n\t\t\t\tif !results.IsTruncated {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinueToken = results.NextContinuationToken\n\t\t\t\tpre = oss.Prefix(results.Prefix)\n\t\t\t}\n\t\t\treturn true, nil\n\t\t})\n\treturn files, err\n}\n\nfunc setBucketLogging(client *oss.Client, bucketName string) error {\n\tif os.Getenv(wfcommon.EnvVarArgoTrace) == \"1\" {\n\t\terr := client.SetBucketLogging(bucketName, bucketName, bucketLogFilePrefix, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to configure bucket logging: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc setBucketLifecycleRule(client *oss.Client, ossArtifact *wfv1.OSSArtifact) error {\n\tif ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays == 0 && ossArtifact.LifecycleRule.MarkDeletionAfterDays == 0 {\n\t\treturn nil\n\t}\n\tvar markInfrequentAccessAfterDays int\n\tvar markDeletionAfterDays int\n\tif ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays != 0 {\n\t\tmarkInfrequentAccessAfterDays = int(ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays)\n\t}\n\tif ossArtifact.LifecycleRule.MarkDeletionAfterDays != 0 {\n\t\tmarkDeletionAfterDays = int(ossArtifact.LifecycleRule.MarkDeletionAfterDays)\n\t}\n\tif markInfrequentAccessAfterDays > markDeletionAfterDays {","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/oss/oss.go#L338-L374","documentation":"Returned by setBucketLogging when ARGOTRACE=1 is set and client.SetBucketLogging fails. The driver tries to enable server-side access logging on the artifact bucket purely for tracing, and surfaces any OSS API error here. Save/OpenStream/Delete treat this as fatal via the backoff predicate, so a tracing-only feature can fail the whole artifact operation.","triggerScenarios":"Env var ARGO_TRACE=1 (wfcommon.EnvVarArgoTrace) on the workflow controller/executor plus a SetBucketLogging failure: RAM principal lacks oss:PutBucketLogging, bucket owned by another account, or endpoint/region mismatch.","commonSituations":"Enabling debug tracing in a cluster whose artifact credentials are scoped read/write-object only (no bucket-config permissions); locked-down production buckets where logging config is forbidden by RAM policy; hardening setups where ARGO_TRACE was left on from debugging.","solutions":["Grant oss:PutBucketLogging (and GetBucketLogging) to the artifact credentials' RAM policy, or","unset ARGO_TRACE / set it to something other than \"1\" — bucket logging is only needed for trace debugging.","Verify the endpoint/region matches the bucket's home region (SetBucketLogging is region-scoped).","If logging is desired, enable it once out-of-band via the console/ossutil instead of per-operation driver calls.","If transient, re-run — non-transient errors abort the artifact operation immediately."],"exampleFix":"// before (controller/executor env)\nARGO_TRACE=1\n// after\nARGO_TRACE=0  # or remove; alternatively grant oss:PutBucketLogging if tracing is required","handlingStrategy":"fallback","validationCode":"// verify before enabling trace mode\nif os.Getenv(\"ARGO_TRACE\") == \"1\" {\n\tcli, _ := oss.New(endpoint, ak, sk)\n\tif err := cli.SetBucketLogging(bucketName, bucketName, \"argo-trace\", true); err != nil {\n\t\tlog.Printf(\"bucket logging unavailable, disable ARGO_TRACE: %v\", err)\n\t}\n}","typeGuard":"func isLoggingPermissionErr(err error) bool {\n\tse, ok := err.(oss.ServiceError)\n\treturn ok && (se.Code == \"AccessDenied\" || se.Code == \"NoSuchBucketLogging\")\n}","tryCatchPattern":"if err := driver.Save(ctx, path, artifact); err != nil {\n\tif strings.Contains(err.Error(), \"failed to configure bucket logging\") {\n\t\tlog.Warn(\"ARGO_TRACE bucket logging failed; continuing without trace logging\")\n\t\tos.Unsetenv(\"ARGO_TRACE\") // fall back to non-traced operation\n\t}\n}","preventionTips":["Leave ARGO_TRACE unset/0 in production; enable only in debug environments where credentials have bucket-config rights.","If tracing is required, add oss:PutBucketLogging/oss:GetBucketLogging to the artifact RAM policy.","Configure bucket logging once via console/ossutil instead of relying on per-operation driver calls.","Avoid granting broad bucket-admin rights just for tracing — prefer disabling the feature."],"tags":["oss","bucket-logging","tracing","permissions"],"backgroundTag":"oss-access-denied","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}