{"record":{"id":"684b7d0f639c067b","repo":"argoproj/argo-workflows","slug":"failed-to-check-if-secret-s-exists-w","errorCode":null,"errorMessage":"failed to check if secret %s exists: %w","messagePattern":"failed to check if secret (.+?) exists: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/agent.go","lineNumber":92,"sourceCode":"\t}\n\treturn newPhase, message\n}\n\nfunc (woc *wfOperationCtx) secretExists(ctx context.Context, name string) (bool, error) {\n\t_, err := woc.controller.kubeclientset.CoreV1().Secrets(woc.wf.Namespace).Get(ctx, name, metav1.GetOptions{})\n\tif err != nil {\n\t\tif apierr.IsNotFound(err) {\n\t\t\treturn false, nil\n\t\t}\n\t\treturn false, err\n\t}\n\treturn true, nil\n}\n\nfunc (woc *wfOperationCtx) getCertVolumeMount(ctx context.Context, name string) (*apiv1.Volume, *apiv1.VolumeMount, error) {\n\texists, err := woc.secretExists(ctx, name)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to check if secret %s exists: %w\", name, err)\n\t}\n\tif exists {\n\t\tcertVolume := &apiv1.Volume{\n\t\t\tName: name,\n\t\t\tVolumeSource: apiv1.VolumeSource{\n\t\t\t\tSecret: &apiv1.SecretVolumeSource{\n\t\t\t\t\tSecretName: name,\n\t\t\t\t},\n\t\t\t}}\n\n\t\tcertVolumeMount := &apiv1.VolumeMount{\n\t\t\tName:      name,\n\t\t\tMountPath: \"/etc/ssl/certs/ca-certificates/\",\n\t\t\tReadOnly:  true,\n\t\t}\n\n\t\treturn certVolume, certVolumeMount, nil\n\t}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/agent.go#L74-L110","documentation":"When building the Agent pod, createAgentPod needs to mount the controller's CA certificate, stored as a Kubernetes Secret. getCertVolumeMount first checks the secret exists via woc.secretExists; if that check itself errors (API/informer failure rather than a clean 'not found'), the error is wrapped as 'failed to check if secret %s exists: %w'.","triggerScenarios":"The informer/API call behind secretExists returns an error — e.g. k8s API server unreachable, RBAC denial on reading secrets in the workflow namespace, or a timeout — while reconciling a workflow that needs the agent pod.","commonSituations":"Controller service account lacks get/list secrets RBAC in the namespace; API server briefly unavailable during reconciliation; network policy blocking controller→API traffic; misconfigured kubeconfig in local development.","solutions":["Check the controller logs for the wrapped inner error to identify RBAC vs connectivity cause","Ensure the argo workflow-controller ServiceAccount has RBAC to get secrets in workflow namespaces","Verify API server connectivity from the controller pod (kubectl exec into it and test the API endpoint)","If transient, re-run/retry the workflow — the informer will recover"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"kubectl auth can-i get secrets -n <workflow-namespace> --as=system:serviceaccount:argo:workflow-controller","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var status *apierrors.StatusError\n    if errors.As(err, &status) && status.Status().Reason == metav1.StatusReasonForbidden {\n        // fix RBAC then re-reconcile\n    }\n}","preventionTips":["Grant the controller ServiceAccount secret read RBAC in workflow namespaces","Verify API server connectivity from controller pods","Include secret-listing checks in controller health checks"],"tags":["kubernetes","rbac","secrets","argo-workflows"],"backgroundTag":"rbac-permission-denied","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}