{"record":{"id":"5edc347eddfb5f71","repo":"argoproj/argo-workflows","slug":"error-getting-config-map-for-artifact-repository-r","errorCode":null,"errorMessage":"error getting config map for artifact repository ref \"%v\": %w","messagePattern":"error getting config map for artifact repository ref \"(.+?)\": %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifactrepositories/artifactrepositories.go","lineNumber":57,"sourceCode":"\tvar refs []*wfv1.ArtifactRepositoryRefStatus\n\tif ref != nil {\n\t\trefs = []*wfv1.ArtifactRepositoryRefStatus{\n\t\t\t{Namespace: workflowNamespace, ArtifactRepositoryRef: wfv1.ArtifactRepositoryRef{ConfigMap: ref.ConfigMap, Key: ref.Key}},\n\t\t\t{Namespace: s.namespace, ArtifactRepositoryRef: wfv1.ArtifactRepositoryRef{ConfigMap: ref.ConfigMap, Key: ref.Key}},\n\t\t}\n\t} else {\n\t\trefs = []*wfv1.ArtifactRepositoryRefStatus{\n\t\t\t{Namespace: workflowNamespace},\n\t\t\t{Default: true},\n\t\t}\n\t}\n\tfor _, r := range refs {\n\t\tresolvedRef, err := s.get(ctx, r)\n\t\tif err != nil && (apierr.IsNotFound(err) || strings.Contains(err.Error(), \"config map missing key\")) {\n\t\t\tcontinue\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(`error getting config map for artifact repository ref \"%v\": %w`, r, err)\n\t\t}\n\t\tlogging.RequireLoggerFromContext(ctx).WithField(\"artifactRepositoryRef\", r).Info(ctx, \"resolved artifact repository\")\n\t\treturn resolvedRef, nil\n\t}\n\treturn nil, fmt.Errorf(`failed to find any artifact repository for artifact repository ref \"%v\"`, ref)\n}\n\nfunc (s *artifactRepositories) Get(ctx context.Context, ref *wfv1.ArtifactRepositoryRefStatus) (*wfv1.ArtifactRepository, error) {\n\tref, err := s.get(ctx, ref)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn ref.ArtifactRepository, nil\n}\n\nfunc (s *artifactRepositories) get(ctx context.Context, ref *wfv1.ArtifactRepositoryRefStatus) (*wfv1.ArtifactRepositoryRefStatus, error) {\n\tif ref.ArtifactRepository != nil {\n\t\treturn ref, nil","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifactrepositories/artifactrepositories.go#L39-L75","documentation":"The controller failed to fetch the ConfigMap referenced by a workflow's artifactRepositoryRef while resolving which artifact repository to use. Unlike NotFound or missing-key (which are skipped to try the next candidate), this is a persistent/unexpected error (RBAC denial, API server failure, timeout after retries) and is fatal to resolution.","triggerScenarios":"artifactRepositories.Resolve iterating candidate refs calls s.get, whose ConfigMap GET fails with a non-NotFound, non-'config map missing key' error — e.g. Forbidden due to missing RBAC on configmaps, API server unreachable, or transient error persisting past retry.DefaultRetry.","commonSituations":"workflow-controller ServiceAccount lacks get on configmaps in the workflow namespace; network policy or API outage; custom artifactRepositoryRef pointing at a ConfigMap in a namespace the controller can't read; typo causing lookups against a wrong namespace.","solutions":["Check the wrapped cause after the colon (RBAC Forbidden / timeout / connection refused) and fix it","Grant the workflow-controller ServiceAccount get on configmaps in the workflow namespace (ClusterRole/Role binding)","Verify the artifactRepositoryRef configMap name and namespace in the workflow spec are correct","Confirm the API server is reachable from the controller (network policies, DNS)","If the ref simply doesn't exist, expect NotFound to be skipped — this error means something other than absence"],"exampleFix":"# before: controller cannot read configmaps\n# after: grant access\nkubectl -n <workflow-namespace> create role argo-cm-reader --resource=configmaps --verb=get\nkubectl -n <workflow-namespace> create rolebinding argo-cm-reader --role=argo-cm-reader --serviceaccount=<ns>:workflow-controller","handlingStrategy":"try-catch","validationCode":"// caller can preflight the referenced ConfigMap\n_, err := kube.CoreV1().ConfigMaps(refNamespace).Get(ctx, refConfigMapName, metav1.GetOptions{})\nif err != nil && !apierr.IsNotFound(err) {\n    return fmt.Errorf(\"configmap lookup will fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"_, err := repos.Resolve(ctx, ref, wfNamespace)\nif err != nil {\n    if strings.Contains(err.Error(), \"error getting config map\") {\n        // inspect cause: Forbidden vs timeout; check RBAC and API server health\n        return diagnoseConfigMapAccess(err, refNamespace)\n    }\n    return err\n}","preventionTips":["Ensure the workflow-controller ServiceAccount can get configmaps in all workflow namespaces","Keep artifactRepositoryRef namespaces within RBAC reach of the controller","Distinguish NotFound (skipped, benign) from other errors — alert only on non-NotFound","Monitor API server connectivity from the controller"],"tags":["kubernetes","configmap","rbac","artifact-repository"],"backgroundTag":"configmap-access-denied","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}