{"record":{"id":"7b3919b733e26dca","repo":"argoproj/argo-workflows","slug":"failed-to-parse-private-key-w","errorCode":null,"errorMessage":"failed to parse private key: %w","messagePattern":"failed to parse private key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":208,"sourceCode":"\t\tData:       map[string][]byte{cookieEncryptionPrivateKeySecretKey: x509.MarshalPKCS1PrivateKey(generatedKey)},\n\t}, metav1.CreateOptions{})\n\tisSecretAlreadyExists := false\n\tif err != nil {\n\t\tisSecretAlreadyExists = apierr.IsAlreadyExists(err)\n\t\tif !isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to create secret: %w\", err)\n\t\t}\n\t}\n\tsecret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret: %w\", err)\n\t}\n\tprivateKey, err := x509.ParsePKCS1PrivateKey(secret.Data[cookieEncryptionPrivateKeySecretKey])\n\tif err != nil {\n\t\tif isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse private key. If you have already defined a Secret named %s, delete it and retry: %w\", secretName, err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to parse private key: %w\", err)\n\t}\n\n\tclientID := clientIDObj.Data[c.ClientID.Key]\n\tif clientID == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientID.Key, c.ClientID.Name)\n\t}\n\tclientSecret := clientSecretObj.Data[c.ClientSecret.Key]\n\tif clientSecret == nil {\n\t\treturn nil, fmt.Errorf(\"key %s missing in secret %s\", c.ClientSecret.Key, c.ClientSecret.Name)\n\t}\n\tconfig := &oauth2.Config{\n\t\tClientID:     string(clientID),\n\t\tClientSecret: string(clientSecret),\n\t\tRedirectURL:  c.RedirectURL,\n\t\tEndpoint:     provider.Endpoint(),\n\t\tScopes:       append(c.Scopes, oidc.ScopeOpenID),\n\t}\n\tidTokenVerifier := provider.Verifier(&oidc.Config{ClientID: config.ClientID})","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L190-L226","documentation":"Same ParsePKCS1PrivateKey failure, but in the normal path where argo itself just created (or freshly read) the argo-sso secret, so a corrupt pre-existing secret is not suspected; instead the freshly stored data failed to parse, which points to an unexpected mutation or corruption of the secret data.","triggerScenarios":"New() after create succeeded (or secret already existed but created in same code path without AlreadyExists), yet secret.Data['cookie-secret-key'] fails x509.ParsePKCS1PrivateKey.","commonSituations":"A controller/mutating webhook rewrote the secret's data (e.g. base64 re-encoding or field stripping); version mismatch between argo components where the secret format changed; storage corruption.","solutions":["kubectl -n argo delete secret argo-sso and restart argo-server so a fresh key is generated","Compare secret data to what argo writes: base64(DER PKCS#1 RSA key) under 'cookie-secret-key'","Look for mutating webhooks or backup/restore tooling that alters secret payloads","Check if the secret was created by a different argo-server version and whether any logs show it being modified"],"exampleFix":"# before\nkubectl get secret argo-sso -o jsonpath='{.data.cookie-secret-key}' | base64 -d # garbage\n# after\nkubectl delete secret argo-sso -n argo && kubectl -n argo rollout restart deploy/argo-server","handlingStrategy":"try-catch","validationCode":"secret, _ := secretsIf.Get(ctx, \"argo-sso\", metav1.GetOptions{})\nif secret != nil {\n    if _, err := x509.ParsePKCS1PrivateKey(secret.Data[\"cookie-secret-key\"]); err != nil {\n        _ = secretsIf.Delete(ctx, \"argo-sso\", metav1.DeleteOptions{})\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    if strings.Contains(err.Error(), \"failed to parse private key\") {\n        _ = secretsIf.Delete(ctx, \"argo-sso\", metav1.DeleteOptions{})\n        return fmt.Errorf(\"cookie secret corrupted; deleted for regeneration, restart argo-server\")\n    }\n    return err\n}","preventionTips":["Exclude the argo-sso secret from mutating webhooks and secret re-encryption tooling","Pin all argo components to the same version","Monitor secret changes with kubernetes audit logs"],"tags":["x509","secrets","sso","kubernetes"],"backgroundTag":"invalid-private-key-secret","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}