{"record":{"id":"c825763fbb8a7a07","repo":"argoproj/argo-workflows","slug":"failed-to-create-new-s3-client-w","errorCode":null,"errorMessage":"failed to create new S3 client: %w","messagePattern":"failed to create new S3 client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/s3/s3.go","lineNumber":197,"sourceCode":"\t\t}\n\t\t// Wrap transport with OpenTelemetry tracing\n\t\topts.Transport = tracing.WrapS3Transport(tr)\n\t}\n\n\treturn NewClient(ctx, opts)\n}\n\n// Load downloads artifacts from S3 compliant storage\nfunc (s3Driver *ArtifactDriver) Load(ctx context.Context, inputArtifact *wfv1.Artifact, path string) error {\n\tctx, cancel := context.WithCancel(ctx)\n\tdefer cancel()\n\tlog := logging.RequireLoggerFromContext(ctx)\n\terr := waitutil.Backoff(executorretry.ExecutorRetry(ctx),\n\t\tfunc() (bool, error) {\n\t\t\tlog.WithFields(logging.Fields{\"path\": path, \"key\": inputArtifact.S3.Key}).Info(ctx, \"S3 Load\")\n\t\t\ts3cli, err := s3Driver.newClient(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientS3Err(ctx, err), fmt.Errorf(\"failed to create new S3 client: %w\", err)\n\t\t\t}\n\t\t\treturn loadS3Artifact(ctx, s3cli, inputArtifact, path)\n\t\t})\n\n\treturn err\n}\n\n// loadS3Artifact downloads artifacts from an S3 compliant storage\n// returns true if the download is completed or can't be retried (non-transient error)\n// returns false if it can be retried (transient error)\nfunc loadS3Artifact(ctx context.Context, s3cli Client, inputArtifact *wfv1.Artifact, path string) (bool, error) {\n\torigErr := s3cli.GetFile(inputArtifact.S3.Bucket, inputArtifact.S3.Key, path)\n\tif origErr == nil {\n\t\treturn true, nil\n\t}\n\tif !IsS3ErrCode(origErr, \"NoSuchKey\") {\n\t\treturn !isTransientS3Err(ctx, origErr), fmt.Errorf(\"failed to get file: %w\", origErr)\n\t}","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/s3/s3.go#L179-L215","documentation":"Raised by the S3 artifact driver's Load when s3Driver.newClient fails to construct an S3 client during artifact download, inside the executor retry backoff. It wraps the underlying client-construction error (bad credentials, bad endpoint, invalid TLS/CA config, etc.). The backoff retries while isTransientS3Err classifies the error as transient; non-transient failures stop retrying.","triggerScenarios":"Executor downloading an S3 input artifact where the S3 client cannot be created: invalid accessKeySecret/secretKeySecret references, malformed endpoint URL, unreadable or invalid trusted CA (s3Driver.TrustedCA PEM), unsupported addressing style, or env/IRSA credential misconfiguration.","commonSituations":"Typo'd or missing Kubernetes secret keys for S3 credentials; self-hosted MinIO with wrong endpoint or missing insecure flag; custom CA not mounted into the executor pod; wrong s3AddressingStyle for the provider; region mismatch causing client init failure.","solutions":["Read the wrapped inner error to identify the root cause (credentials, endpoint, TLS)","Verify the S3 credential secret exists and its keys match accessKeySecret/secretKeySecret in the artifact spec","Check endpoint URL, insecure flag, and addressing style for self-hosted S3 (MinIO etc.)","Ensure s3TrustedCA / TLS config: CA secret mounted and PEM valid if Secure with custom CA","If the error is transient (e.g. temporary credential-fetch failure), the executor retries automatically — check IRSA/service account configuration for persistent failures"],"exampleFix":"# before: secret key name typo\ns3:\n  accessKeySecret: {name: s3-creds, key: accessKey}\n  secretKeySecret: {name: s3-creds, key: secretKey}\n# after: correct key names matching the secret\ns3:\n  accessKeySecret: {name: s3-creds, key: accesskey}\n  secretKeySecret: {name: s3-creds, key: secretkey}","handlingStrategy":"retry","validationCode":"// validate S3 artifact config before submission\nif art.S3 == nil || art.S3.Bucket == \"\" || art.S3.Endpoint == \"\" {\n    return fmt.Errorf(\"s3 artifact must define bucket and endpoint\")\n}\nif art.S3.AccessKeySecret != nil {\n    if _, err := kubeClient.CoreV1().Secrets(ns).Get(ctx, art.S3.AccessKeySecret.Name, metav1.GetOptions{}); err != nil {\n        return fmt.Errorf(\"s3 credential secret missing: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := driver.Load(ctx, artifact, path)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create new S3 client\") {\n        // non-transient init failure: do NOT hot-retry blindly;\n        // fix credentials/endpoint/TLS then re-run the step\n    }\n    return err\n}","preventionTips":["Validate S3 credential secrets exist and key names match before submitting workflows","Test endpoint/insecure/addressing-style settings against your S3 provider (MinIO vs AWS)","Mount and verify custom CA certs when using Secure with s3TrustedCA","Keep transient-retry behavior in mind: isTransientS3Err controls backoff, so fix root causes rather than escalating retries"],"tags":["s3","artifact","aws","configuration","client-init"],"backgroundTag":"s3-client-init-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}