{"record":{"id":"731a5843f202f777","repo":"argoproj/argo-workflows","slug":"failed-to-list-workflowartifactgctasks-w","errorCode":null,"errorMessage":"failed to List WorkflowArtifactGCTasks: %w","messagePattern":"failed to List WorkflowArtifactGCTasks: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/artifact_gc.go","lineNumber":656,"sourceCode":"\twoc.log.WithField(\"podName\", pod.Name).Info(ctx, \"processing completed Artifact GC Pod\")\n\n\tstrategyStr, found := pod.Annotations[common.AnnotationKeyArtifactGCStrategy]\n\tif !found {\n\t\treturn fmt.Errorf(\"artifact gc pod %q missing annotation %q\", pod.Name, common.AnnotationKeyArtifactGCStrategy)\n\t}\n\tstrategy := wfv1.ArtifactGCStrategy(strategyStr)\n\n\tif pod.Status.Phase == corev1.PodFailed {\n\t\terrMsg := fmt.Sprintf(\"Artifact Garbage Collection failed for strategy %s, pod %s exited with non-zero exit code: check pod logs for more information\", strategy, pod.Name)\n\t\twoc.addArtGCCondition(errMsg)\n\t\twoc.addArtGCEvent(errMsg)\n\t}\n\n\t// get associated WorkflowArtifactGCTasks\n\tlabelSelector := fmt.Sprintf(\"%s = %s\", common.LabelKeyArtifactGCPodHash, woc.artifactGCPodLabel(pod.Name))\n\ttaskList, err := woc.controller.wfclientset.ArgoprojV1alpha1().WorkflowArtifactGCTasks(woc.wf.Namespace).List(ctx, metav1.ListOptions{LabelSelector: labelSelector})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to List WorkflowArtifactGCTasks: %w\", err)\n\t}\n\n\tfor _, task := range taskList.Items {\n\t\tallArtifactsSucceeded, err := woc.processCompletedWorkflowArtifactGCTask(ctx, &task, strategy)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif allArtifactsSucceeded && pod.Status.Phase == corev1.PodSucceeded {\n\t\t\t// now we can delete it, if it succeeded (otherwise we leave it up to be inspected)\n\t\t\twoc.log.WithField(\"name\", task.Name).Debug(ctx, \"deleting WorkflowArtifactGCTask\")\n\t\t\terr := woc.controller.wfclientset.ArgoprojV1alpha1().WorkflowArtifactGCTasks(woc.wf.Namespace).Delete(ctx, task.Name, metav1.DeleteOptions{})\n\t\t\tif err != nil {\n\t\t\t\twoc.log.WithField(\"name\", task.Name).WithError(err).Error(ctx, \"error deleting WorkflowArtifactGCTask\")\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}","sourceCodeStart":638,"sourceCodeEnd":674,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/artifact_gc.go#L638-L674","documentation":"After an artifact GC pod completes, the controller lists WorkflowArtifactGCTasks labeled with the pod's FNV hash (LabelKeyArtifactGCPodHash) to evaluate per-artifact deletion results. Any List API failure is wrapped at workflow/controller/artifact_gc.go:656 — most often RBAC denial or API-server unavailability.","triggerScenarios":"GET /apis/argoproj.io/v1alpha1/.../workflowartifactgctasks?labelSelector=... fails: controller service account lacks list permission; API server timeout/network error; namespace terminating; aggregated admission or quota issues.","commonSituations":"RBAC tightened without workflowartifactgctasks/list; API server overload during large cluster events; label selector passing through a validating proxy that rejects it.","solutions":["Inspect the wrapped error: 403 -> grant list on workflowartifactgctasks to the workflow-controller service account (compare with manifests/install.yaml RBAC for your version).","For timeouts/connection errors, check API server health and controller-to-API-server network; the reconcile is requeued so transient failures self-heal.","Verify the CRD is installed and functioning: kubectl get workflowartifactgctasks -n <ns>.","If a proxy/webhook strips label selectors, exempt argoproj.io API traffic from it."],"exampleFix":"// before: ClusterRole missing list on the GC task resource\n// after\nrules:\n  - apiGroups: [\"argoproj.io\"]\n    resources: [\"workflowartifactgctasks\"]\n    verbs: [\"list\", \"get\", \"watch\", \"delete\"]","handlingStrategy":"retry","validationCode":"cmd := exec.Command(\"kubectl\", \"auth\", \"can-i\", \"list\", \"workflowartifactgctasks.argoproj.io\",\n    \"-n\", ns, \"--as\", \"system:serviceaccount:argo:workflow-controller\")","typeGuard":"apierr.IsForbidden(err) // distinguishes RBAC from transient API failures","tryCatchPattern":"if listErr != nil {\n    if apierr.IsForbidden(listErr) { /* fix RBAC permanently */ }\n    // otherwise transient: controller requeue will retry automatically\n}","preventionTips":["Grant the controller list/get/watch on workflowartifactgctasks per your version's install manifests.","Monitor API server latency; GC reconciliation runs on every workflow delete.","Verify CRD installation in cluster bootstrap checks.","Avoid proxies that mangle labelSelector query parameters."],"tags":["kubernetes","rbac","api-server","artifact-gc"],"backgroundTag":"kubernetes-api-list-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}