{"record":{"id":"29a13d583918bbe8","repo":"argoproj/argo-workflows","slug":"failed-to-create-new-oss-client-w","errorCode":null,"errorMessage":"failed to create new OSS client: %w","messagePattern":"failed to create new OSS client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/oss/oss.go","lineNumber":114,"sourceCode":"\t// ref: https://help.aliyun.com/zh/cli/use-an-http-proxy-server#section-5yf-ejl-jwf\n\tif proxy, ok := os.LookupEnv(\"https_proxy\"); ok {\n\t\toptions = append(options, oss.Proxy(proxy))\n\t}\n\n\tif token := ossDriver.SecurityToken; token != \"\" {\n\t\toptions = append(options, oss.SecurityToken(token))\n\t}\n\n\tlogger := logging.RequireLoggerFromContext(ctx)\n\tif ossDriver.UseSDKCreds {\n\t\t// using default provider chains in sdk to get credential\n\t\tlogger.Info(ctx, \"Using default sdk provider chains for OSS driver\")\n\t\t// need install ack-pod-identity-webhook in your cluster when using oidc provider for OSS drirver\n\t\t// the mutating webhook will help to inject the required OIDC env variables and toke volume mount configuration\n\t\t// please refer to https://www.alibabacloud.com/help/en/ack/product-overview/ack-pod-identity-webhook\n\t\tcred, err := credentials.NewCredential(nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create new OSS client: %w\", err)\n\t\t}\n\t\tprovider := &ossCredentialsProvider{cred: cred, logger: logger}\n\t\treturn oss.New(ossDriver.Endpoint, \"\", \"\", oss.SetCredentialsProvider(provider))\n\t}\n\tlogger.Info(ctx, \"Using AK provider\")\n\tclient, err := oss.New(ossDriver.Endpoint, ossDriver.AccessKey, ossDriver.SecretKey, options...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create new OSS client: %w\", err)\n\t}\n\treturn client, err\n}\n\n// Load downloads artifacts from OSS compliant storage, e.g., downloading an artifact into local path\nfunc (ossDriver *ArtifactDriver) Load(ctx context.Context, inputArtifact *wfv1.Artifact, path string) error {\n\terr := waitutil.Backoff(defaultRetry,\n\t\tfunc() (bool, error) {\n\t\t\tlogging.RequireLoggerFromContext(ctx).WithFields(logging.Fields{\"path\": path, \"key\": inputArtifact.OSS.Key}).Info(ctx, \"OSS Load\")\n\t\t\tosscli, err := ossDriver.newOSSClient(ctx)","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/oss/oss.go#L96-L132","documentation":"newOSSClient wraps any failure from the aliyun-oss-go-sdk credential/client constructors with 'failed to create new OSS client'. This instance fires on the SDK-credentials path: credentials.NewCredential(nil) failed to assemble a default provider-chain credential (env vars, RAM role, OIDC-injected config). The workflow's OSS access cannot even be initialized.","triggerScenarios":"Using `useSDKCreds: true` on an OSS artifact without valid ambient credentials: no OSS_* env vars, no RAM/STSRoleArn, and no OIDC webhook-injected ALIBABA_CREDENTIAL_URI / token file in the pod; credentials.NewCredential(nil) returns an error.","commonSituations":"Forgetting to install the ack-pod-identity-webhook so OIDC env vars and token volume mounts never reach the pod; running outside ACK/RAM where the default provider chain can't resolve anything; SDK provider-chain changes in newer aliyun SDK versions.","solutions":["Install/configure the ack-pod-identity-webhook so the pod receives OIDC credential env vars and token volume mounts.","Set valid OSS credential env vars (AccessKey ID/Secret, or STS token) in the container so the default provider chain resolves.","Fall back to static accessKey/secretKey (and optional securityToken) on the artifact's oss config instead of useSDKCreds.","Confirm the pod's service account has an RRSA/OIDC role bound in ACK; check with `kubectl exec ... env | grep ALIBABA`.","Check logs for 'Using default sdk provider chains for OSS driver' to confirm which branch failed."],"exampleFix":"// before\n- name: app\n  artifacts:\n    outputs:\n      - name: out\n        oss:\n          endpoint: http://oss-cn-hangzhou.aliyuncs.com\n          bucket: b\n          key: k\n          useSDKCreds: true  # no provider chain in pod\n// after: either install ack-pod-identity-webhook, or use explicit creds\n        oss:\n          endpoint: http://oss-cn-hangzhou.aliyuncs.com\n          bucket: b\n          key: k\n          accessKeySecret:\n            name: oss-creds\n            key: accessKey\n          secretKeySecret:\n            name: oss-creds\n            key: secretKey","handlingStrategy":"validation","validationCode":"// before submitting, ensure ambient creds exist when useSDKCreds is set\nrequired := []string{\"ALIBABA_CREDENTIAL_URI\", \"ACCESS_KEY_ID\", \"OSS_ACCESS_KEY_ID\"}\nfor _, k := range required {\n\tif os.Getenv(k) != \"\" {\n\t\treturn nil\n\t}\n}\nreturn fmt.Errorf(\"no OSS ambient credentials in pod; install ack-pod-identity-webhook or set static keys\")","typeGuard":null,"tryCatchPattern":"cli, err := ossDriver.newOSSClient(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to create new OSS client\") {\n\t// retry with static accessKey/secretKey fallback configuration\n}","preventionTips":["Install ack-pod-identity-webhook before enabling useSDKCreds on ACK","Verify with `kubectl exec ... env` that OIDC credential env vars reach the pod","Keep static accessKeySecret/secretKeySecret as a documented fallback","Bind pod service accounts to RAM roles (RRSA) when using provider chains"],"tags":["oss","aliyun","credentials","client-initialization","oidc"],"backgroundTag":"missing-cloud-credentials","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}