{"record":{"id":"c021b9c3273555a4","repo":"argoproj/argo-workflows","slug":"failed-to-get-service-account-s-w","errorCode":null,"errorMessage":"failed to get service account \"%s\": %w","messagePattern":"failed to get service account \"(.+?)\": %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/webhook/interceptor.go","lineNumber":103,"sourceCode":"\tif len(buf) > maxWebhookSize {\n\t\treturn fmt.Errorf(\"webhook request body exceeds maximum size of 2MB\")\n\t}\n\tdefer func() { r.Body = io.NopCloser(bytes.NewBuffer(buf)) }()\n\tserviceAccountInterface := kube.CoreV1().ServiceAccounts(namespace)\n\tfor serviceAccountName, data := range webhookClients.Data {\n\t\tr.Body = io.NopCloser(bytes.NewBuffer(buf))\n\t\tclient := &webhookClient{}\n\t\terr := yaml.Unmarshal(data, client)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to unmarshal webhook client \\\"%s\\\": %w\", serviceAccountName, err)\n\t\t}\n\t\ti.logger.WithFields(logging.Fields{\"serviceAccountName\": serviceAccountName, \"webhookType\": client.Type}).Debug(r.Context(), \"Attempting to match webhook request\")\n\t\tok := webhookParsers[client.Type](client.Secret, r)\n\t\tif ok {\n\t\t\ti.logger.WithField(\"serviceAccountName\", serviceAccountName).Debug(r.Context(), \"Matched webhook request\")\n\t\t\tserviceAccount, err := serviceAccountInterface.Get(ctx, serviceAccountName, metav1.GetOptions{})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to get service account \\\"%s\\\": %w\", serviceAccountName, err)\n\t\t\t}\n\t\t\ttokenSecret, err := secretsInterface.Get(ctx, secrets.TokenNameForServiceAccount(serviceAccount), metav1.GetOptions{})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to get token secret \\\"%s\\\": %w\", tokenSecret, err)\n\t\t\t}\n\t\t\tr.Header[\"Authorization\"] = []string{\"Bearer \" + string(tokenSecret.Data[\"token\"])}\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":85,"sourceCodeEnd":115,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/webhook/interceptor.go#L85-L115","documentation":"After a webhook request matches a client entry's secret parser, the interceptor looks up the named ServiceAccount in the ConfigMap's namespace via the Kubernetes API. This error is returned when that Get fails — most commonly the ServiceAccount does not exist (404), or the server lacks RBAC permission to read it. Without it the interceptor cannot fetch the token to impersonate the caller.","triggerScenarios":"Webhook request matched a webhook-clients entry whose key names a ServiceAccount that was deleted, renamed, exists in a different namespace than the event endpoint's namespace, or the argo-server service account lacks get on serviceaccounts in that namespace.","commonSituations":"Namespace recreated without the ServiceAccount; ConfigMap copied between namespaces keeping stale SA names; argo-server deployed with a ClusterRole missing `serviceaccounts` get; typo between the ConfigMap key and the actual SA name.","solutions":["Verify the ServiceAccount exists: `kubectl get sa <name> -n <namespace>` (namespace is the one in the webhook URL).","Recreate it if missing: `kubectl create sa <name> -n <namespace>` and attach the expected RBAC role for workflow submission.","Make the webhook-clients ConfigMap key exactly match the ServiceAccount name.","Check argo-server RBAC allows `get serviceaccounts` and `get secrets` in the namespace (`kubectl auth can-i get serviceaccounts -n <ns> --as=system:serviceaccount:<ns>:argo-server`).","Inspect the wrapped %w error in the argo-server logs to distinguish NotFound from Forbidden."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := clientset.CoreV1().ServiceAccounts(ns).Get(ctx, saName, metav1.GetOptions{}); err != nil {\n\treturn fmt.Errorf(\"webhook client SA %q missing: %w\", saName, err)\n}\nok, _ := kube.AuthCanI(clientset, \"system:serviceaccount:argo:argo-server\", \"get\", \"serviceaccounts\", ns)","typeGuard":null,"tryCatchPattern":"sa, err := clientset.CoreV1().ServiceAccounts(ns).Get(ctx, saName, metav1.GetOptions{})\nif errors.IsNotFound(err) {\n\t// recreate SA or fix ConfigMap key\n} else if err != nil {\n\t// check RBAC / API server reachability\n}","preventionTips":["Ensure each webhook-clients key exactly equals an existing ServiceAccount name","Deploy the SA together with the ConfigMap in the same manifest/Helm release","Grant argo-server get on serviceaccounts in webhook namespaces","Diff ConfigMap keys vs `kubectl get sa` in CI"],"tags":["kubernetes","serviceaccount","rbac","webhook"],"backgroundTag":"service-account-not-found","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}