{"record":{"id":"6f9e419305940fdc","repo":"argoproj/argo-workflows","slug":"failed-to-read-secret-w","errorCode":null,"errorMessage":"failed to read secret: %w","messagePattern":"failed to read secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":201,"sourceCode":"\t}\n\t// whoa - are you ignoring errors - yes - we don't care if it fails -\n\t// if it fails, then the get will fail, and the pod restart\n\t// it may fail due to race condition with another pod - which is fine,\n\t// when it restart it'll get the new key\n\t_, err = secretsIf.Create(ctx, &apiv1.Secret{\n\t\tObjectMeta: metav1.ObjectMeta{Name: secretName},\n\t\tData:       map[string][]byte{cookieEncryptionPrivateKeySecretKey: x509.MarshalPKCS1PrivateKey(generatedKey)},\n\t}, metav1.CreateOptions{})\n\tisSecretAlreadyExists := false\n\tif err != nil {\n\t\tisSecretAlreadyExists = apierr.IsAlreadyExists(err)\n\t\tif !isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to create secret: %w\", err)\n\t\t}\n\t}\n\tsecret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret: %w\", err)\n\t}\n\tprivateKey, err := x509.ParsePKCS1PrivateKey(secret.Data[cookieEncryptionPrivateKeySecretKey])\n\tif err != nil {\n\t\tif isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse private key. If you have already defined a Secret named %s, delete it and retry: %w\", secretName, err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to parse private key: %w\", err)\n\t}\n\n\tclientID := clientIDObj.Data[c.ClientID.Key]\n\tif clientID == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientID.Key, c.ClientID.Name)\n\t}\n\tclientSecret := clientSecretObj.Data[c.ClientSecret.Key]\n\tif clientSecret == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientSecret.Key, c.ClientSecret.Name)\n\t}\n\tconfig := &oauth2.Config{","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L183-L219","documentation":"After optionally creating the 'argo-sso' cookie secret, newSso re-reads it with secretsIf.Get. If that Get fails (RBAC, not found, API error), construction aborts with 'failed to read secret' wrapping the kubernetes error.","triggerScenarios":"secretsIf.Get(ctx, secretName) returning an error during New() — secret deleted between create and get, get permission denied, or API server/transient failure.","commonSituations":"A mutating controller or cron job deletes the argo-sso secret; RBAC allows create but not get; kubernetes API briefly unavailable at pod startup.","solutions":["Inspect the wrapped error (NotFound vs Forbidden)","Grant the argo-server SA get permission on secrets in the namespace","Recreate/restart so the secret is re-created; stop whatever deletes argo-sso","Check namespace/pod disruption events around the startup time"],"exampleFix":"# before\n# argo-server can create secrets but not read them\n# after\nkind: Role\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    verbs: [\"create\", \"get\"]","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    if strings.Contains(err.Error(), \"failed to read secret\") && apierrors.IsNotFound(err) {\n        // secret was deleted mid-startup: safe to retry pod start\n        return fmt.Errorf(\"argo-sso secret vanished, restart: %w\", err)\n    }\n    return err\n}","preventionTips":["Do not run cleaners that delete secrets in the argo namespace","Ensure get permission on secrets for the argo-server SA","Exclude 'argo-sso' from backup-restore and pruning tools"],"tags":["kubernetes","secrets","rbac","sso"],"backgroundTag":"kubernetes-rbac-forbidden","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}