{"record":{"id":"9f959844e1fedf17","repo":"argoproj/argo-workflows","slug":"failed-to-read-bearer-token-file-w","errorCode":null,"errorMessage":"failed to read bearer token file: %w","messagePattern":"failed to read bearer token file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":40,"sourceCode":"\t}\n\n\tif restConfig.BearerToken != \"\" || restConfig.BearerTokenFile != \"\" {\n\t\treturn ClaimSetWithBearerToken(restConfig)\n\t}\n\n\tif restConfig.CertFile != \"\" || len(restConfig.CertData) > 0 {\n\t\treturn ClaimSetWithX509(restConfig)\n\t}\n\treturn nil, nil\n}\n\nfunc ClaimSetWithBearerToken(restConfig *rest.Config) (*types.Claims, error) {\n\tbearerToken := restConfig.BearerToken\n\tif bearerToken == \"\" {\n\t\t// should only ever be used for service accounts\n\t\tdata, err := os.ReadFile(restConfig.BearerTokenFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read bearer token file: %w\", err)\n\t\t}\n\t\tbearerToken = string(data)\n\t}\n\n\tparts := strings.SplitN(bearerToken, \".\", 3)\n\tif len(parts) != 3 {\n\t\treturn nil, fmt.Errorf(\"expected bearer token to be a JWT and therefore have 3 dot-delimited parts\")\n\t}\n\tpayload := parts[1]\n\tdata, err := base64.RawStdEncoding.DecodeString(payload)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode bearer token's JWT payload: %w\", err)\n\t}\n\n\tclaims := &types.Claims{}\n\terr = json.Unmarshal(data, &claims)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshal bearer token's JWT payload: %w\", err)","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L22-L58","documentation":"ClaimSetWithBearerToken needed to read the bearer token from disk (restConfig.BearerTokenFile) because no inline token was set, and os.ReadFile failed. The SA-token file is missing or unreadable in the argo-server container.","triggerScenarios":"Thrown at server/auth/serviceaccount/claims.go:40 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the service account token file is mounted at the configured path","Check file permissions for the argo-server process"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}