argoproj/argo-workflows · error

failed to compile sso.filterGroupRegex

Error message

failed to compile sso.filterGroupRegex: %s %w

What it means

At SSO configuration load time (newSso), each `sso.filterGroupRegex` entry is compiled with regexp.Compile. If any entry is not a valid Go RE2 regular expression, startup is aborted with this error wrapping the underlying regexp parse error. Argo server cannot serve SSO auth until the config is fixed.

Solutions

1. Fix the offending regex in the `argo-workflows-sso` config so it is valid Go RE2 syntax
2. Test the regex locally with `go run` / https://regex101.com (select Go/Golang flavor) before deploying
3. Remove unsupported constructs (lookaheads/lookbehinds, backreferences) and re-express the pattern
4. Restart the argo-server and confirm it comes up

Example fix

// before
filterGroupRegex:
  - "^argo-(?!readonly)"   # invalid: negative lookahead unsupported in Go
// after
filterGroupRegex:
  - "^argo-[a-z0-9-]+"    # valid RE2

for _, r := range cfg.FilterGroupsRegex {
    if _, err := regexp.Compile(r); err != nil {
        return fmt.Errorf("invalid filterGroupRegex %q: %w", r, err)
    }
}

When it happens

Trigger: `argo server` starts (or SSO config is reloaded) with an `sso.filterGroupRegex` list in the `argo-workflows-sso` ConfigMap/Secret containing syntactically invalid regex, e.g. unbalanced `(`, trailing `+`, or unsupported PCRE constructs like `(?<=x)` lookahead/lookbehind (Go RE2 does not support them).

Common situations: Copying regexes from PCRE/JS-flavored docs into the SSO config; hand-editing YAML and breaking escaping (e.g. `\b` in a YAML double-quoted string); typos like `^group-(`.

Related errors

• clientID empty
• failed to append certificates from PEM string
• issuer empty
• must specify at least one auth mode
• no claim found for key

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/838d2dfa1c67f960. Report an issue: GitHub.

Appendix: source

Thrown at server/auth/sso/sso.go:245

	// The server both mints and verifies these tokens, so symmetric AEAD is
	// sufficient: encryption with A256GCM also authenticates, and go-jose v4
	// only permits encrypt-only JWTs with symmetric algorithms. Asymmetric
	// encryption needed a nested signature, which pushed the cookie over the
	// 4KB browser limit (https://github.com/argoproj/argo-workflows/issues/16744).
	// The AES key is derived from the RSA key already stored in the secret so
	// that existing installations don't need a secret migration.
	encryptionKey := sha256.Sum256(x509.MarshalPKCS1PrivateKey(privateKey))
	encrypter, err := jose.NewEncrypter(jose.A256GCM, jose.Recipient{Algorithm: jose.DIRECT, Key: encryptionKey[:]}, &jose.EncrypterOptions{Compression: jose.DEFLATE})
	if err != nil {
		return nil, fmt.Errorf("failed to create JWT encrypter: %w", err)
	}

	var filterGroupsRegex []*regexp.Regexp
	if len(c.FilterGroupsRegex) > 0 {
		for _, regex := range c.FilterGroupsRegex {
			compiledRegex, err := regexp.Compile(regex)
			if err != nil {
				return nil, fmt.Errorf("failed to compile sso.filterGroupRegex: %s %w", regex, err)
			}
			filterGroupsRegex = append(filterGroupsRegex, compiledRegex)
		}
	}

	lf := logging.Fields{"redirectUrl": config.RedirectURL, "logoutRedirectUrl": c.LogoutRedirectURL, "issuer": c.Issuer, "issuerAlias": "DISABLED", "clientId": c.ClientID, "scopes": config.Scopes, "insecureSkipVerify": c.InsecureSkipVerify, "filterGroupsRegex": c.FilterGroupsRegex, "rootCA": c.RootCA}
	if c.IssuerAlias != "" {
		lf["issuerAlias"] = c.IssuerAlias
	}
	logger := logging.RequireLoggerFromContext(ctx).WithFields(lf)
	logger.Info(ctx, "SSO configuration")

	return &sso{
		config:            config,
		logoutURL:         logoutURL,
		logoutRedirectURL: c.LogoutRedirectURL,
		idTokenVerifier:   idTokenVerifier,
		baseHRef:          baseHRef,

View on GitHub (pinned to 35bff19146)