argoproj/argo-workflows · error

cannot get resource clusterWorkflowTemplate at cluster scope

Error message

cannot get resource clusterWorkflowTemplate at cluster scope

What it means

When a workflow references a cluster-scoped WorkflowTemplate (workflowTemplateRef.clusterScope: true), the controller must have a ClusterWorkflowTemplate informer. If RBAC/feature flags did not start that informer (cwftmplInformer == nil), the controller cannot read the template and fails with this error.

Source

Thrown at workflow/controller/operator.go:4460

		woc.updated = true
	}

	name := getStepOrDAGTaskName(nodeName)
	return woc.hasOutputResultRef(ctx, name, parentTemplate), nil
}

func (woc *wfOperationCtx) fetchWorkflowSpec(ctx context.Context) (wfv1.WorkflowSpecHolder, error) {
	if woc.wf.Spec.WorkflowTemplateRef == nil { //nolint:forbidigo // not-woc-misuse
		return nil, fmt.Errorf("cannot fetch workflow spec without workflowTemplateRef")
	}

	var specHolder wfv1.WorkflowSpecHolder
	var err error
	// Logic for workflow refers Workflow template
	if woc.wf.Spec.WorkflowTemplateRef.ClusterScope { //nolint:forbidigo // not-woc-misuse
		if woc.controller.cwftmplInformer == nil {
			woc.log.WithError(err).Error(ctx, "clusterWorkflowTemplate RBAC is missing")
			return nil, fmt.Errorf("cannot get resource clusterWorkflowTemplate at cluster scope")
		}
		woc.controller.metrics.CountWorkflowTemplate(ctx, metrics.WorkflowNew, woc.wf.Spec.WorkflowTemplateRef.Name, woc.wf.Namespace, true) //nolint:forbidigo // not-woc-misuse
		specHolder, err = woc.controller.cwftmplInformer.Lister().Get(woc.wf.Spec.WorkflowTemplateRef.Name)                                  //nolint:forbidigo // not-woc-misuse
	} else {
		woc.controller.metrics.CountWorkflowTemplate(ctx, metrics.WorkflowNew, woc.wf.Spec.WorkflowTemplateRef.Name, woc.wf.Namespace, false)  //nolint:forbidigo // not-woc-misuse
		specHolder, err = woc.controller.wftmplInformer.Lister().WorkflowTemplates(woc.wf.Namespace).Get(woc.wf.Spec.WorkflowTemplateRef.Name) //nolint:forbidigo // not-woc-misuse
	}
	if err != nil {
		return nil, err
	}
	return specHolder, nil
}

func (woc *wfOperationCtx) retryStrategy(tmpl *wfv1.Template) *wfv1.RetryStrategy {
	if tmpl != nil && tmpl.RetryStrategy != nil {
		return tmpl.RetryStrategy
	}
	return woc.execWf.Spec.RetryStrategy

View on GitHub (pinned to 35bff19146)

Solutions

1. Grant the controller's service account RBAC access to clusterworkflowtemplates (cluster-scope list/get/watch)
2. Restart/redeploy the controller so the ClusterWorkflowTemplate informer is created
3. Alternatively use a namespaced WorkflowTemplate (clusterScope: false) if cluster templates are not needed

Example fix

// before (controller RBAC missing cluster scope)
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtemplates]
    verbs: [get, list, watch]
// after
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtemplates, clusterworkflowtemplates]
    verbs: [get, list, watch]

// before submitting with clusterScope: true, check RBAC
kubectl auth can-i get clusterworkflowtemplates.argoproj.io --as=system:serviceaccount:argo:workflow-controller

func clusterScope(wf *wfv1.Workflow) bool { return wf.Spec.WorkflowTemplateRef != nil && wf.Spec.WorkflowTemplateRef.ClusterScope }

if err != nil && strings.Contains(err.Error(), "clusterWorkflowTemplate") {
    // fall back to namespaced template or fix controller RBAC
}

When it happens

Trigger: A workflow sets spec.workflowTemplateRef.clusterScope: true but the controller was started without the clusterWorkflowTemplate RBAC/permissions (informer not registered), so cwftmplInformer is nil during reconciliation.

Common situations: Cluster install without the ClusterWorkflowTemplate role/rolebinding for the controller service account; controller started with the feature disabled; switching a workflow from namespaced to cluster-scoped template without updating controller permissions.

Related errors

• invalid spec: clusterworkflowtemplates.argoproj.io `%s` is f
• failed to list SSO RBAC service accounts: %w
• failed to get workflow template: %w
• failed to check if secret %s exists: %w
• failed to get token volumes: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/9a508e189aa7d7d9. Report an issue: GitHub.