{"record":{"id":"9a508e189aa7d7d9","repo":"argoproj/argo-workflows","slug":"cannot-get-resource-clusterworkflowtemplate-at-clu","errorCode":null,"errorMessage":"cannot get resource clusterWorkflowTemplate at cluster scope","messagePattern":"cannot get resource clusterWorkflowTemplate at cluster scope","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/operator.go","lineNumber":4460,"sourceCode":"\t\twoc.updated = true\n\t}\n\n\tname := getStepOrDAGTaskName(nodeName)\n\treturn woc.hasOutputResultRef(ctx, name, parentTemplate), nil\n}\n\nfunc (woc *wfOperationCtx) fetchWorkflowSpec(ctx context.Context) (wfv1.WorkflowSpecHolder, error) {\n\tif woc.wf.Spec.WorkflowTemplateRef == nil { //nolint:forbidigo // not-woc-misuse\n\t\treturn nil, fmt.Errorf(\"cannot fetch workflow spec without workflowTemplateRef\")\n\t}\n\n\tvar specHolder wfv1.WorkflowSpecHolder\n\tvar err error\n\t// Logic for workflow refers Workflow template\n\tif woc.wf.Spec.WorkflowTemplateRef.ClusterScope { //nolint:forbidigo // not-woc-misuse\n\t\tif woc.controller.cwftmplInformer == nil {\n\t\t\twoc.log.WithError(err).Error(ctx, \"clusterWorkflowTemplate RBAC is missing\")\n\t\t\treturn nil, fmt.Errorf(\"cannot get resource clusterWorkflowTemplate at cluster scope\")\n\t\t}\n\t\twoc.controller.metrics.CountWorkflowTemplate(ctx, metrics.WorkflowNew, woc.wf.Spec.WorkflowTemplateRef.Name, woc.wf.Namespace, true) //nolint:forbidigo // not-woc-misuse\n\t\tspecHolder, err = woc.controller.cwftmplInformer.Lister().Get(woc.wf.Spec.WorkflowTemplateRef.Name)                                  //nolint:forbidigo // not-woc-misuse\n\t} else {\n\t\twoc.controller.metrics.CountWorkflowTemplate(ctx, metrics.WorkflowNew, woc.wf.Spec.WorkflowTemplateRef.Name, woc.wf.Namespace, false)  //nolint:forbidigo // not-woc-misuse\n\t\tspecHolder, err = woc.controller.wftmplInformer.Lister().WorkflowTemplates(woc.wf.Namespace).Get(woc.wf.Spec.WorkflowTemplateRef.Name) //nolint:forbidigo // not-woc-misuse\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn specHolder, nil\n}\n\nfunc (woc *wfOperationCtx) retryStrategy(tmpl *wfv1.Template) *wfv1.RetryStrategy {\n\tif tmpl != nil && tmpl.RetryStrategy != nil {\n\t\treturn tmpl.RetryStrategy\n\t}\n\treturn woc.execWf.Spec.RetryStrategy","sourceCodeStart":4442,"sourceCodeEnd":4478,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/operator.go#L4442-L4478","documentation":"When a workflow references a cluster-scoped WorkflowTemplate (workflowTemplateRef.clusterScope: true), the controller must have a ClusterWorkflowTemplate informer. If RBAC/feature flags did not start that informer (cwftmplInformer == nil), the controller cannot read the template and fails with this error.","triggerScenarios":"A workflow sets spec.workflowTemplateRef.clusterScope: true but the controller was started without the clusterWorkflowTemplate RBAC/permissions (informer not registered), so cwftmplInformer is nil during reconciliation.","commonSituations":"Cluster install without the ClusterWorkflowTemplate role/rolebinding for the controller service account; controller started with the feature disabled; switching a workflow from namespaced to cluster-scoped template without updating controller permissions.","solutions":["Grant the controller's service account RBAC access to clusterworkflowtemplates (cluster-scope list/get/watch)","Restart/redeploy the controller so the ClusterWorkflowTemplate informer is created","Alternatively use a namespaced WorkflowTemplate (clusterScope: false) if cluster templates are not needed"],"exampleFix":"// before (controller RBAC missing cluster scope)\nrules:\n  - apiGroups: [argoproj.io]\n    resources: [workflowtemplates]\n    verbs: [get, list, watch]\n// after\nrules:\n  - apiGroups: [argoproj.io]\n    resources: [workflowtemplates, clusterworkflowtemplates]\n    verbs: [get, list, watch]","handlingStrategy":"validation","validationCode":"// before submitting with clusterScope: true, check RBAC\nkubectl auth can-i get clusterworkflowtemplates.argoproj.io --as=system:serviceaccount:argo:workflow-controller","typeGuard":"func clusterScope(wf *wfv1.Workflow) bool { return wf.Spec.WorkflowTemplateRef != nil && wf.Spec.WorkflowTemplateRef.ClusterScope }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"clusterWorkflowTemplate\") {\n    // fall back to namespaced template or fix controller RBAC\n}","preventionTips":["Install the full Argo RBAC manifest including clusterworkflowtemplates","Avoid clusterScope unless cluster templates are genuinely needed","Test controller permissions after upgrades"],"tags":["kubernetes","rbac","argo-workflows","clusterworkflowtemplate"],"backgroundTag":"rbac-permission-missing","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}