{"record":{"id":"de146ef4cac942cd","repo":"argoproj/argo-workflows","slug":"failed-to-create-workflowartifactgctask-q-for-gar","errorCode":null,"errorMessage":"failed to Create WorkflowArtifactGCTask %q for Garbage Collection: %w","messagePattern":"failed to Create WorkflowArtifactGCTask %q for Garbage Collection: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/artifact_gc.go","lineNumber":371,"sourceCode":"\t}\n\treturn task.(*wfv1.WorkflowArtifactGCTask), nil\n}\n\n// create WorkflowArtifactGCTask CRD object\nfunc (woc *wfOperationCtx) createWorkflowArtifactGCTask(ctx context.Context, task *wfv1.WorkflowArtifactGCTask) (*wfv1.WorkflowArtifactGCTask, error) {\n\t// first make sure it doesn't already exist\n\tfoundTask, err := woc.getArtifactTask(task.Name)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif foundTask != nil {\n\t\twoc.log.WithField(\"task\", task.Name).Debug(ctx, \"Artifact GC Task already exists\")\n\t} else {\n\t\twoc.log.WithField(\"task\", task.Name).Info(ctx, \"Creating Artifact GC Task\")\n\n\t\ttask, err = woc.controller.wfclientset.ArgoprojV1alpha1().WorkflowArtifactGCTasks(woc.wf.Namespace).Create(ctx, task, metav1.CreateOptions{})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to Create WorkflowArtifactGCTask %q for Garbage Collection: %w\", task.Name, err)\n\t\t}\n\t}\n\treturn task, nil\n}\n\n// create the Pod which will do the deletions\nfunc (woc *wfOperationCtx) createArtifactGCPod(ctx context.Context, strategy wfv1.ArtifactGCStrategy, tasks []*wfv1.WorkflowArtifactGCTask,\n\tinfo podInfo, podName string, templatesToArtList templatesToArtifacts, templatesByName map[string]*wfv1.Template) (*corev1.Pod, error) {\n\twoc.log.WithFields(logging.Fields{\"strategy\": strategy, \"podName\": podName}).Info(ctx, \"creating pod to delete artifacts\")\n\n\t// Pod is owned by WorkflowArtifactGCTasks, so it will die automatically when all of them have died\n\townerReferences := make([]metav1.OwnerReference, len(tasks))\n\tfor i, task := range tasks {\n\t\t// make sure pod gets deleted with the WorkflowArtifactGCTasks\n\t\townerReferences[i] = *metav1.NewControllerRef(task, wfv1.SchemeGroupVersion.WithKind(workflow.WorkflowArtifactGCTaskKind))\n\t}\n\n\tartifactLocations := make([]*wfv1.ArtifactLocation, 0)","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/artifact_gc.go#L353-L389","documentation":"createWorkflowArtifactGCTask creates a WorkflowArtifactGCTask custom resource via the Argo clientset when the informer cache says it doesn't exist. Any Create failure other than 'already exists handled upstream' is wrapped here at workflow/controller/artifact_gc.go:371 — typically RBAC denial, validation failure, or API-server issues.","triggerScenarios":"POST to /apis/argoproj.io/v1alpha1/.../workflowartifactgctasks fails: RBAC forbids the controller's service account; the CR is invalid (e.g. >1MB, bad ownerRef); the resource was created by another actor between cache check and Create (AlreadyExists); namespace is terminating; API server unreachable.","commonSituations":"Workflow-controller ClusterRole missing argoproj.io/workflowartifactgctasks create permission after manual RBAC tightening or partial upgrade; namespace stuck in Terminating; admission webhooks rejecting the object.","solutions":["Check the wrapped %w error in controller logs: if 403, grant the workflow-controller service account create on workflowartifactgctasks (check manifests/install.yaml RBAC for your version).","If AlreadyExists, it's benign — the informer cache was stale; the next reconcile will pick up the existing task.","If validation error, inspect the task payload (often CR size); reduce artifacts per workflow or upgrade to a version that splits tasks.","Verify the namespace is Active and the WorkflowArtifactGCTask CRD is installed: kubectl get crd workflowartifactgctasks.argoproj.io."],"exampleFix":"// before: controller RBAC lacks the CRD verb\n// after: add to the workflow-controller ClusterRole\nrules:\n  - apiGroups: [\"argoproj.io\"]\n    resources: [\"workflowartifactgctasks\"]\n    verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"patch\", \"delete\"]","handlingStrategy":"try-catch","validationCode":"// Pre-check RBAC with kubectl auth\ncmd := exec.Command(\"kubectl\", \"auth\", \"can-i\", \"create\", \"workflowartifactgctasks.argoproj.io\",\n    \"-n\", ns, \"--as\", \"system:serviceaccount:argo:workflow-controller\")","typeGuard":"apierr.IsAlreadyExists(err)  // benign stale-cache race; other statuses need action","tryCatchPattern":"if createErr != nil {\n    if status := apierr.IsForbidden(createErr); status { /* fix controller RBAC */ }\n    if apierr.IsAlreadyExists(createErr) { /* stale cache — safe to ignore */ }\n}","preventionTips":["Keep controller RBAC in sync with manifests/install.yaml after upgrades.","Verify the WorkflowArtifactGCTask CRD is installed in the cluster.","Avoid manual RBAC tightening on the argo service account without checking artifact GC verbs.","Watch namespace state (not Terminating) before deleting artifact-bearing workflows."],"tags":["kubernetes","rbac","crd","artifact-gc","api-server"],"backgroundTag":"kubernetes-api-create-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}