argoproj/argo-workflows · error

failed to check if secret %s exists: %w

Error message

failed to check if secret %s exists: %w

What it means

When building the Agent pod, createAgentPod needs to mount the controller's CA certificate, stored as a Kubernetes Secret. getCertVolumeMount first checks the secret exists via woc.secretExists; if that check itself errors (API/informer failure rather than a clean 'not found'), the error is wrapped as 'failed to check if secret %s exists: %w'.

Source

Thrown at workflow/controller/agent.go:92

	}
	return newPhase, message
}

func (woc *wfOperationCtx) secretExists(ctx context.Context, name string) (bool, error) {
	_, err := woc.controller.kubeclientset.CoreV1().Secrets(woc.wf.Namespace).Get(ctx, name, metav1.GetOptions{})
	if err != nil {
		if apierr.IsNotFound(err) {
			return false, nil
		}
		return false, err
	}
	return true, nil
}

func (woc *wfOperationCtx) getCertVolumeMount(ctx context.Context, name string) (*apiv1.Volume, *apiv1.VolumeMount, error) {
	exists, err := woc.secretExists(ctx, name)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to check if secret %s exists: %w", name, err)
	}
	if exists {
		certVolume := &apiv1.Volume{
			Name: name,
			VolumeSource: apiv1.VolumeSource{
				Secret: &apiv1.SecretVolumeSource{
					SecretName: name,
				},
			}}

		certVolumeMount := &apiv1.VolumeMount{
			Name:      name,
			MountPath: "/etc/ssl/certs/ca-certificates/",
			ReadOnly:  true,
		}

		return certVolume, certVolumeMount, nil
	}

View on GitHub (pinned to 35bff19146)

Solutions

1. Check the controller logs for the wrapped inner error to identify RBAC vs connectivity cause
2. Ensure the argo workflow-controller ServiceAccount has RBAC to get secrets in workflow namespaces
3. Verify API server connectivity from the controller pod (kubectl exec into it and test the API endpoint)
4. If transient, re-run/retry the workflow — the informer will recover

kubectl auth can-i get secrets -n <workflow-namespace> --as=system:serviceaccount:argo:workflow-controller

if err != nil {
    var status *apierrors.StatusError
    if errors.As(err, &status) && status.Status().Reason == metav1.StatusReasonForbidden {
        // fix RBAC then re-reconcile
    }
}

When it happens

Trigger: The informer/API call behind secretExists returns an error — e.g. k8s API server unreachable, RBAC denial on reading secrets in the workflow namespace, or a timeout — while reconciling a workflow that needs the agent pod.

Common situations: Controller service account lacks get/list secrets RBAC in the namespace; API server briefly unavailable during reconciliation; network policy blocking controller→API traffic; misconfigured kubeconfig in local development.

Related errors

• failed to list SSO RBAC service accounts: %w
• failed to get service account secret: %w
• failed to create secret: %w
• failed to read secret: %w
• failed to get workflow template: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/684b7d0f639c067b. Report an issue: GitHub.