{"record":{"id":"e4dc07b95198b7db","repo":"argoproj/argo-workflows","slug":"failed-to-get-token-volumes-w","errorCode":null,"errorMessage":"failed to get token volumes: %w","messagePattern":"failed to get token volumes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/agent.go","lineNumber":158,"sourceCode":"\t\t{Name: common.EnvVarWorkflowName, Value: woc.wf.Name},\n\t\t{Name: common.EnvVarWorkflowUID, Value: string(woc.wf.UID)},\n\t\t{Name: common.EnvAgentPatchRate, Value: env.LookupEnvStringOr(common.EnvAgentPatchRate, woc.controller.requeueTime.String())},\n\t\t{Name: common.EnvVarPluginAddresses, Value: wfv1.MustMarshallJSON(addresses(pluginSidecars))},\n\t\t{Name: common.EnvVarPluginNames, Value: wfv1.MustMarshallJSON(names(pluginSidecars))},\n\t}\n\n\t// If the default number of task workers is overridden, then pass it to the agent pod.\n\tif taskWorkers, exists := os.LookupEnv(common.EnvAgentTaskWorkers); exists {\n\t\tenvVars = append(envVars, apiv1.EnvVar{\n\t\t\tName:  common.EnvAgentTaskWorkers,\n\t\t\tValue: taskWorkers,\n\t\t})\n\t}\n\n\tserviceAccountName := woc.execWf.Spec.ServiceAccountName\n\ttokenVolume, tokenVolumeMount, err := woc.getServiceAccountTokenVolume(ctx, serviceAccountName)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get token volumes: %w\", err)\n\t}\n\n\tpodVolumes := slices.Concat(\n\t\tpluginVolumes,\n\t\t[]apiv1.Volume{volumeVarArgo, *tokenVolume},\n\t)\n\tpodVolumeMounts := []apiv1.VolumeMount{\n\t\tvolumeMountVarArgo,\n\t\t*tokenVolumeMount,\n\t}\n\tif certVolume != nil && certVolumeMount != nil {\n\t\tpodVolumes = append(podVolumes, *certVolume)\n\t\tpodVolumeMounts = append(podVolumeMounts, *certVolumeMount)\n\t}\n\tagentCtrTemplate := apiv1.Container{\n\t\tCommand:         []string{\"argoexec\"},\n\t\tImage:           woc.controller.executorImage(),\n\t\tImagePullPolicy: woc.controller.executorImagePullPolicy(),","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/agent.go#L140-L176","documentation":"The Agent pod needs a projected ServiceAccount token volume so it can talk to the Kubernetes API (for HTTP templates with selfServeMode and plugins). createAgentPod calls getServiceAccountTokenVolume for the workflow's serviceAccountName; any failure (e.g. the service account does not exist) is wrapped as 'failed to get token volumes: %w'.","triggerScenarios":"Workflow spec sets spec.serviceAccountName to an SA that doesn't exist in the workflow namespace (or the token-volume lookup errors), while the controller builds the agent pod.","commonSituations":"Typo in serviceAccountName; SA defined only in another namespace; SA deleted by a cleanup job after the workflow was submitted; workflows referencing a default SA removed by cluster policy.","solutions":["Create the missing service account: `kubectl create serviceaccount <name> -n <workflow-namespace>`","Correct spec.serviceAccountName in the workflow to an existing SA in the workflow's namespace","Check the wrapped inner error to distinguish 'not found' from RBAC/API failure","Verify the SA exists: `kubectl get sa <name> -n <workflow-namespace>`"],"exampleFix":"# before\nspec:\n  serviceAccountName: argo-wf-sa-typo\n# after\nspec:\n  serviceAccountName: argo-wf-sa","handlingStrategy":"validation","validationCode":"_, err := clientset.CoreV1().ServiceAccounts(ns).Get(ctx, saName, metav1.GetOptions{})\nif apierrors.IsNotFound(err) {\n    return fmt.Errorf(\"service account %s/%s does not exist\", ns, saName)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate spec.serviceAccountName exists in the workflow namespace before submitting (argo lint / admission policy)","Protect SAs from deletion while workflows reference them","Use a dedicated, namespaced SA per workflow namespace"],"tags":["kubernetes","serviceaccount","rbac","argo-workflows"],"backgroundTag":"service-account-not-found","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}