argoproj/argo-workflows · error

error getting config map for artifact repository ref "%v": %

Error message

error getting config map for artifact repository ref "%v": %w

What it means

The controller failed to fetch the ConfigMap referenced by a workflow's artifactRepositoryRef while resolving which artifact repository to use. Unlike NotFound or missing-key (which are skipped to try the next candidate), this is a persistent/unexpected error (RBAC denial, API server failure, timeout after retries) and is fatal to resolution.

Source

Thrown at workflow/artifactrepositories/artifactrepositories.go:57

	var refs []*wfv1.ArtifactRepositoryRefStatus
	if ref != nil {
		refs = []*wfv1.ArtifactRepositoryRefStatus{
			{Namespace: workflowNamespace, ArtifactRepositoryRef: wfv1.ArtifactRepositoryRef{ConfigMap: ref.ConfigMap, Key: ref.Key}},
			{Namespace: s.namespace, ArtifactRepositoryRef: wfv1.ArtifactRepositoryRef{ConfigMap: ref.ConfigMap, Key: ref.Key}},
		}
	} else {
		refs = []*wfv1.ArtifactRepositoryRefStatus{
			{Namespace: workflowNamespace},
			{Default: true},
		}
	}
	for _, r := range refs {
		resolvedRef, err := s.get(ctx, r)
		if err != nil && (apierr.IsNotFound(err) || strings.Contains(err.Error(), "config map missing key")) {
			continue
		}
		if err != nil {
			return nil, fmt.Errorf(`error getting config map for artifact repository ref "%v": %w`, r, err)
		}
		logging.RequireLoggerFromContext(ctx).WithField("artifactRepositoryRef", r).Info(ctx, "resolved artifact repository")
		return resolvedRef, nil
	}
	return nil, fmt.Errorf(`failed to find any artifact repository for artifact repository ref "%v"`, ref)
}

func (s *artifactRepositories) Get(ctx context.Context, ref *wfv1.ArtifactRepositoryRefStatus) (*wfv1.ArtifactRepository, error) {
	ref, err := s.get(ctx, ref)
	if err != nil {
		return nil, err
	}
	return ref.ArtifactRepository, nil
}

func (s *artifactRepositories) get(ctx context.Context, ref *wfv1.ArtifactRepositoryRefStatus) (*wfv1.ArtifactRepositoryRefStatus, error) {
	if ref.ArtifactRepository != nil {
		return ref, nil

View on GitHub (pinned to 35bff19146)

Solutions

1. Check the wrapped cause after the colon (RBAC Forbidden / timeout / connection refused) and fix it
2. Grant the workflow-controller ServiceAccount get on configmaps in the workflow namespace (ClusterRole/Role binding)
3. Verify the artifactRepositoryRef configMap name and namespace in the workflow spec are correct
4. Confirm the API server is reachable from the controller (network policies, DNS)
5. If the ref simply doesn't exist, expect NotFound to be skipped — this error means something other than absence

Example fix

# before: controller cannot read configmaps
# after: grant access
kubectl -n <workflow-namespace> create role argo-cm-reader --resource=configmaps --verb=get
kubectl -n <workflow-namespace> create rolebinding argo-cm-reader --role=argo-cm-reader --serviceaccount=<ns>:workflow-controller

// caller can preflight the referenced ConfigMap
_, err := kube.CoreV1().ConfigMaps(refNamespace).Get(ctx, refConfigMapName, metav1.GetOptions{})
if err != nil && !apierr.IsNotFound(err) {
    return fmt.Errorf("configmap lookup will fail: %w", err)
}

_, err := repos.Resolve(ctx, ref, wfNamespace)
if err != nil {
    if strings.Contains(err.Error(), "error getting config map") {
        // inspect cause: Forbidden vs timeout; check RBAC and API server health
        return diagnoseConfigMapAccess(err, refNamespace)
    }
    return err
}

When it happens

Trigger: artifactRepositories.Resolve iterating candidate refs calls s.get, whose ConfigMap GET fails with a non-NotFound, non-'config map missing key' error — e.g. Forbidden due to missing RBAC on configmaps, API server unreachable, or transient error persisting past retry.DefaultRetry.

Common situations: workflow-controller ServiceAccount lacks get on configmaps in the workflow namespace; network policy or API outage; custom artifactRepositoryRef pointing at a ConfigMap in a namespace the controller can't read; typo causing lookups against a wrong namespace.

Related errors

• failed to find any artifact repository for artifact reposito
• config map missing key "%s" for artifact repository ref "%v"
• memoization configmap doesn't have %s label, refusing to use
• failed to get existing cluster workflow template %q to updat
• failed to unmarshal container args: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/5edc347eddfb5f71. Report an issue: GitHub.