{"record":{"id":"8c4232db3e84ec4c","repo":"argoproj/argo-workflows","slug":"failed-to-create-http-client-w","errorCode":null,"errorMessage":"failed to create HTTP client: %w","messagePattern":"failed to create HTTP client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":146,"sourceCode":"\tif c.ClientID.Name == \"\" || c.ClientID.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientID empty\")\n\t}\n\tif c.ClientSecret.Name == \"\" || c.ClientSecret.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientSecret empty\")\n\t}\n\tclientSecretObj, err := secretsIf.Get(ctx, c.ClientSecret.Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Create http client\n\thttpClientConfig := HTTPClientConfig{\n\t\tInsecureSkipVerify: c.InsecureSkipVerify,\n\t\tRootCA:             c.RootCA,\n\t}\n\thttpClient, err := createHTTPClient(httpClientConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create HTTP client: %w\", err)\n\t}\n\n\toidcContext := oidc.ClientContext(ctx, httpClient)\n\t// Some offspec providers like Azure, Oracle IDCS have oidc discovery url different from issuer url which causes issuerValidation to fail\n\t// This providerCtx will allow the Verifier to succeed if the alternate/alias URL is in the config\n\tif c.IssuerAlias != \"\" {\n\t\toidcContext = oidc.InsecureIssuerURLContext(oidcContext, c.IssuerAlias)\n\t}\n\n\tprovider, err := factory(oidcContext, c.Issuer)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\t// Claims is implemented by oidc.Provider and contains the discovery\n\t// metadata, including the optional end_session_endpoint.\n\tvar providerMetadata struct {\n\t\tEndSessionEndpoint string `json:\"end_session_endpoint\"`\n\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L128-L164","documentation":"newSso builds a custom HTTP client (used for OIDC discovery and token exchange) from the InsecureSkipVerify and RootCA config via createHTTPClient. If that helper fails — typically because the configured RootCA cannot be parsed or read — construction is aborted and the underlying cause is wrapped with this message.","triggerScenarios":"Calling New with sso.rootCA.secretName/rootCA.configMapName pointing at a missing, unreadable, or malformed CA bundle, so tls.X509KeyPool/AppendCertsFromPEM fails inside createHTTPClient.","commonSituations":"Typo or wrong key in the rootCA configmap/secret reference; CA bundle stored as non-PEM data; RBAC preventing argo-server from reading the referenced configmap/secret (often surfaced as the wrapped error).","solutions":["Read the wrapped %w cause to identify the actual failure (bad PEM vs unreadable resource)","Verify sso.rootCA.secretName.keySelector or rootCA.configMapName.key points to a valid PEM-encoded CA cert and that the object exists","Grant argo-server RBAC read access to the referenced secret/configmap","As a diagnostic only, test with the same setup but InsecureSkipVerify enabled, then fix the CA chain properly"],"exampleFix":"# before\nsso:\n  rootCA:\n    configMapName: argo-root-ca\n    key: ca.crt   # key does not exist in the configmap\n# after\nsso:\n  rootCA:\n    configMapName: argo-root-ca\n    key: root-ca.pem  # valid PEM bundle present in the configmap","handlingStrategy":"validation","validationCode":"if cfg.RootCA != nil {\n    var caPEM []byte\n    // fetch from configmap/secret\n    if ok := x509.NewCertPool().AppendCertsFromPEM(caPEM); !ok {\n        return fmt.Errorf(\"rootCA is not a valid PEM certificate bundle\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    var pe *tls.CertificateVerificationError\n    if errors.As(err, &pe) || strings.Contains(err.Error(), \"failed to create HTTP client\") {\n        return fmt.Errorf(\"check sso.rootCA reference and PEM validity: %w\", err)\n    }\n    return err\n}","preventionTips":["Verify the configmap/secret key holding the CA is valid PEM before rollout","Confirm argo-server RBAC can read the rootCA source object","Keep the issuer's full chain in the bundle (leaf + intermediates)"],"tags":["tls","network","sso","config"],"backgroundTag":"tls-root-ca-error","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}