{"record":{"id":"364c815682627ef2","repo":"argoproj/argo-workflows","slug":"failed-to-create-secret-w","errorCode":null,"errorMessage":"failed to create secret: %w","messagePattern":"failed to create secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":196,"sourceCode":"\t\t}\n\t}\n\tgeneratedKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate key: %w\", err)\n\t}\n\t// whoa - are you ignoring errors - yes - we don't care if it fails -\n\t// if it fails, then the get will fail, and the pod restart\n\t// it may fail due to race condition with another pod - which is fine,\n\t// when it restart it'll get the new key\n\t_, err = secretsIf.Create(ctx, &apiv1.Secret{\n\t\tObjectMeta: metav1.ObjectMeta{Name: secretName},\n\t\tData:       map[string][]byte{cookieEncryptionPrivateKeySecretKey: x509.MarshalPKCS1PrivateKey(generatedKey)},\n\t}, metav1.CreateOptions{})\n\tisSecretAlreadyExists := false\n\tif err != nil {\n\t\tisSecretAlreadyExists = apierr.IsAlreadyExists(err)\n\t\tif !isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to create secret: %w\", err)\n\t\t}\n\t}\n\tsecret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret: %w\", err)\n\t}\n\tprivateKey, err := x509.ParsePKCS1PrivateKey(secret.Data[cookieEncryptionPrivateKeySecretKey])\n\tif err != nil {\n\t\tif isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse private key. If you have already defined a Secret named %s, delete it and retry: %w\", secretName, err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to parse private key: %w\", err)\n\t}\n\n\tclientID := clientIDObj.Data[c.ClientID.Key]\n\tif clientID == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientID.Key, c.ClientID.Name)\n\t}","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L178-L214","documentation":"newSso tries to create the kubernetes Secret 'argo-sso' (secretName) holding the generated cookie-encryption private key. Errors are tolerated if the secret already exists (IsAlreadyExists), but any other failure (API server rejection, RBAC denial, quota, transient API error) aborts startup wrapped as 'failed to create secret'.","triggerScenarios":"secretsIf.Create returning an error that is not AlreadyExists during New() — e.g. 403 Forbidden from RBAC, 422 validation, namespace not found, or a transient API server failure.","commonSituations":"Argo's service account lacks create/get on secrets in its namespace (restricted ClusterRole or Pod Security / secret RBAC policies); the argo-server namespace differs from the assumed one; API server outage.","solutions":["Read the wrapped kubernetes error for the concrete API failure (403/422/etc.)","Grant the argo-server service account RBAC: create/get secrets in the namespace (see the sso-clusterroles)","Check for admission policies (OPA/Kyverno/PSA) blocking secret creation","Retry after transient API failures; if persistent, verify the namespace and namespace-scoped RBAC"],"exampleFix":"# before\n# argo-server SA has no secrets create permission\n# after\nkind: Role\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    verbs: [\"create\", \"get\", \"update\"]","handlingStrategy":"try-catch","validationCode":"var secrets corev1.SecretList\nif err := kubectl.AuthCanI(ctx, client, \"create\", \"secrets\"); err != nil {\n    return fmt.Errorf(\"argo-server SA cannot create secrets: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    if strings.Contains(err.Error(), \"failed to create secret\") {\n        return fmt.Errorf(\"check argo-server RBAC create on secrets and admission policies: %w\", err)\n    }\n    return err\n}","preventionTips":["Grant the argo-server SA create/get/update on secrets in its namespace","Audit OPA/Kyverno/PSA policies for secret-creation denials","Pre-create the argo-sso namespace-scoped role before enabling SSO"],"tags":["kubernetes","rbac","secrets","sso"],"backgroundTag":"kubernetes-rbac-forbidden","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}