{"record":{"id":"2ee04bdc62a3d412","repo":"argoproj/argo-workflows","slug":"key-s-missing-in-secret-s","errorCode":null,"errorMessage":"key %s missing in secret %s","messagePattern":"key (.+?) missing in secret (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":213,"sourceCode":"\t\tif !isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to create secret: %w\", err)\n\t\t}\n\t}\n\tsecret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret: %w\", err)\n\t}\n\tprivateKey, err := x509.ParsePKCS1PrivateKey(secret.Data[cookieEncryptionPrivateKeySecretKey])\n\tif err != nil {\n\t\tif isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse private key. If you have already defined a Secret named %s, delete it and retry: %w\", secretName, err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to parse private key: %w\", err)\n\t}\n\n\tclientID := clientIDObj.Data[c.ClientID.Key]\n\tif clientID == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientID.Key, c.ClientID.Name)\n\t}\n\tclientSecret := clientSecretObj.Data[c.ClientSecret.Key]\n\tif clientSecret == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientSecret.Key, c.ClientSecret.Name)\n\t}\n\tconfig := &oauth2.Config{\n\t\tClientID:     string(clientID),\n\t\tClientSecret: string(clientSecret),\n\t\tRedirectURL:  c.RedirectURL,\n\t\tEndpoint:     provider.Endpoint(),\n\t\tScopes:       append(c.Scopes, oidc.ScopeOpenID),\n\t}\n\tidTokenVerifier := provider.Verifier(&oidc.Config{ClientID: config.ClientID})\n\t// The server both mints and verifies these tokens, so symmetric AEAD is\n\t// sufficient: encryption with A256GCM also authenticates, and go-jose v4\n\t// only permits encrypt-only JWTs with symmetric algorithms. Asymmetric\n\t// encryption needed a nested signature, which pushed the cookie over the\n\t// 4KB browser limit (https://github.com/argoproj/argo-workflows/issues/16744).","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L195-L231","documentation":"After loading the client-id secret object, newSso reads the configured key (c.ClientID.Key) from its Data map. A nil value means the secret exists but does not contain that key, so the OAuth client cannot be configured; the error names both the key and the secret for direct debugging.","triggerScenarios":"New() when the secret referenced by sso.clientId.name exists but its data has no entry matching sso.clientId.key (case-sensitive).","commonSituations":"Secret created with --from-file names that differ from the configured key; singular/plural or dash/underscore mismatches ('clientid' vs 'client-id'); YAML key typo; empty-string value (Go []byte(nil)).","solutions":["kubectl -n argo get secret <name> -o yaml and confirm a data entry exactly matching the configured key (case-sensitive)","Recreate the secret with the exact key names, e.g. kubectl create secret generic argo-sso --from-file=client-id=... --from-file=client-secret=...","Align sso.clientId.key in the configmap with the actual secret key","Ensure the value is non-empty"],"exampleFix":"# before\nkubectl create secret generic argo-sso --from-file=clientid=./id\nsso: {clientId: {name: argo-sso, key: client-id}}\n# after\nkubectl create secret generic argo-sso --from-file=client-id=./id\nsso: {clientId: {name: argo-sso, key: client-id}}","handlingStrategy":"validation","validationCode":"idSecret, err := secretsIf.Get(ctx, cfg.ClientID.Name, metav1.GetOptions{})\nif err != nil { return err }\nif _, ok := idSecret.Data[cfg.ClientID.Key]; !ok {\n    return fmt.Errorf(\"secret %s lacks key %s expected by sso.clientId\", cfg.ClientID.Name, cfg.ClientID.Key)\n}","typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    var missErr *fmt.Errorf // check message pattern\n    if strings.Contains(err.Error(), \"missing in secret\") {\n        return fmt.Errorf(\"fix secret key names to match sso.clientId.key: %w\", err)\n    }\n    return err\n}","preventionTips":["Create the secret with exactly the key names the config references: kubectl create secret generic argo-sso --from-file=client-id=... --from-file=client-secret=...","Remember data keys are case-sensitive and live under 'data', not 'stringData', after apply","Diff rendered configmap sso keys against the actual secret keys before rollout"],"tags":["sso","secrets","config","kubernetes"],"backgroundTag":"missing-secret-key","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}