{"record":{"id":"e0265849e6495bab","repo":"argoproj/argo-workflows","slug":"failed-to-create-workflow-w","errorCode":null,"errorMessage":"failed to create workflow: %w","messagePattern":"failed to create workflow: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/event/dispatch/operation.go","lineNumber":166,"sourceCode":"\t\t\t\t}\n\t\t\t\tprogram, compileErr := expr.Compile(p.ValueFrom.Event, expr.Env(o.env))\n\t\t\t\tif compileErr != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to compile workflow template parameter %s expression: %w\", p.Name, compileErr)\n\t\t\t\t}\n\t\t\t\tresult, runErr := expr.Run(program, o.env)\n\t\t\t\tif runErr != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to evaluate workflow template parameter \\\"%s\\\" expression: %w\", p.Name, runErr)\n\t\t\t\t}\n\t\t\t\tdata, marshalErr := json.Marshal(result)\n\t\t\t\tif marshalErr != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to convert result to JSON \\\"%s\\\" expression: %w\", p.Name, marshalErr)\n\t\t\t\t}\n\t\t\t\twf.Spec.Arguments.Parameters = append(wf.Spec.Arguments.Parameters, wfv1.Parameter{Name: p.Name, Value: wfv1.AnyStringPtr(wfv1.Item{Value: data})})\n\t\t\t}\n\t\t}\n\t\twf, err = client.ArgoprojV1alpha1().Workflows(wfeb.Namespace).Create(ctx, wf, metav1.CreateOptions{})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create workflow: %w\", err)\n\t\t}\n\t\treturn wf, nil\n\t}\n\treturn nil, nil\n}\n\nfunc (o *Operation) populateWorkflowMetadata(wf *wfv1.Workflow, metadata *metav1.ObjectMeta) error {\n\tif len(metadata.Name) > 0 {\n\t\tevalName, err := o.evaluateStringExpression(metadata.Name, \"name\")\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\twf.SetName(evalName)\n\t}\n\tif len(metadata.GenerateName) > 0 {\n\t\tevalName, err := o.evaluateStringExpression(metadata.GenerateName, \"generateName\")\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/event/dispatch/operation.go#L148-L184","documentation":"This error wraps the Kubernetes API error returned when the event dispatcher calls Workflows(ns).Create(ctx, wf) after successfully building and evaluating the Workflow from the EventBinding's referenced WorkflowTemplate. It means the Workflow object was constructed fine but the API server rejected or failed the creation (admission webhook, RBAC, name conflict, quota, invalid spec). The underlying Kubernetes error is preserved via %w.","triggerScenarios":"Any call to Create on the argoproj.io Workflows resource during event dispatch that returns a non-nil error: 403 RBAC denial for the event dispatcher's service account, admission webhook rejection (e.g. invalid generated name, invalid labels/annotations from workflowMetadata or evaluated metadata expressions), exceeded ResourceQuota, already-existing workflow name when metadata.name was set to a fixed value, or transient API server/connection failure.","commonSituations":"EventBus/EventBinding set up but the argo-server/controller service account lacks create-workflow RBAC in the binding's namespace; user set workflowMetadata name to a static string so a second event collides (AlreadyExists); namespace has a ResourceQuota; a validating webhook (policy) rejects the generated labels/annotations as too long or invalid.","solutions":["Unwrap the %w error and read the Kubernetes reason: Forbidden -> fix RBAC (grant the argo-server SA 'create workflows' in the EventBinding namespace), AlreadyExists -> make metadata.name/generateName dynamic via an expression","If the name is static in workflowMetadata, change it to an expr like `workflow.name + '-' + (sprig.randAlpha(5))` or drop it to use generateName","Check ResourceQuota/LimitRange in the target namespace and raise it or free quota","For webhook/validation rejections, inspect the admission webhook message and shorten/fix labels, annotations, or the workflow spec","If transient (connection refused/timeout), verify the k8s API is reachable and add retry/backoff on the dispatch side"],"exampleFix":"// before: static name collides on repeat events\nworkflowMetadata:\n  name: my-workflow\n// after\nworkflowMetadata:\n  generateName: my-workflow-\n# or dynamic:\n#   name: 'my-workflow-' + string(metadata.body.id)","handlingStrategy":"try-catch","validationCode":"// Pre-flight: check RBAC + name collision before dispatch\n_, err := client.ArgoprojV1alpha1().Workflows(ns).List(ctx, metav1.ListOptions{\n    FieldSelector: \"metadata.name=\" + desiredName})\nif err == nil && len(items) > 0 { /* name exists — pick another */ }\n// and verify: kubectl auth can-i create workflows.argoproj.io -n <ns> --as=system:serviceaccount:<ns>:argo-server","typeGuard":null,"tryCatchPattern":"wf, err := client.ArgoprojV1alpha1().Workflows(ns).Create(ctx, wf, metav1.CreateOptions{})\nif err != nil {\n    switch {\n    case kerrors.IsForbidden(err):\n        // fix RBAC: grant create on workflows.argoproj.io in this namespace\n    case kerrors.IsAlreadyExists(err):\n        // switch to generateName or append a random suffix\n    case kerrors.IsInvalid(err):\n        // inspect details: fix labels/annotations/quota violations\n    default:\n        if !kerrors.IsTransientErr(ctx, err) { return err }\n        // retry with backoff for transient API errors\n    }\n}","preventionTips":["Grant the event-dispatcher service account create permission on workflows.argoproj.io in every EventBinding namespace","Prefer generateName (or an expr-derived name) over static workflowMetadata.name to avoid AlreadyExists","Check namespace ResourceQuota before relying on event-triggered workflows","Log the unwrapped k8s error reason for fast triage"],"tags":["kubernetes-api","workflow-creation","rbac","argo-workflows"],"backgroundTag":"k8s-api-create-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}