argoproj/argo-workflows · warning

failed to configure bucket logging: %w

Error message

failed to configure bucket logging: %w

What it means

Returned by setBucketLogging when ARGOTRACE=1 is set and client.SetBucketLogging fails. The driver tries to enable server-side access logging on the artifact bucket purely for tracing, and surfaces any OSS API error here. Save/OpenStream/Delete treat this as fatal via the backoff predicate, so a tracing-only feature can fail the whole artifact operation.

Source

Thrown at workflow/artifacts/oss/oss.go:356

				for _, object := range results.Objects {
					files = append(files, object.Key)
				}
				if !results.IsTruncated {
					break
				}
				continueToken = results.NextContinuationToken
				pre = oss.Prefix(results.Prefix)
			}
			return true, nil
		})
	return files, err
}

func setBucketLogging(client *oss.Client, bucketName string) error {
	if os.Getenv(wfcommon.EnvVarArgoTrace) == "1" {
		err := client.SetBucketLogging(bucketName, bucketName, bucketLogFilePrefix, true)
		if err != nil {
			return fmt.Errorf("failed to configure bucket logging: %w", err)
		}
	}
	return nil
}

func setBucketLifecycleRule(client *oss.Client, ossArtifact *wfv1.OSSArtifact) error {
	if ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays == 0 && ossArtifact.LifecycleRule.MarkDeletionAfterDays == 0 {
		return nil
	}
	var markInfrequentAccessAfterDays int
	var markDeletionAfterDays int
	if ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays != 0 {
		markInfrequentAccessAfterDays = int(ossArtifact.LifecycleRule.MarkInfrequentAccessAfterDays)
	}
	if ossArtifact.LifecycleRule.MarkDeletionAfterDays != 0 {
		markDeletionAfterDays = int(ossArtifact.LifecycleRule.MarkDeletionAfterDays)
	}
	if markInfrequentAccessAfterDays > markDeletionAfterDays {

View on GitHub (pinned to 35bff19146)

Solutions

1. Grant oss:PutBucketLogging (and GetBucketLogging) to the artifact credentials' RAM policy, or
2. unset ARGO_TRACE / set it to something other than "1" — bucket logging is only needed for trace debugging.
3. Verify the endpoint/region matches the bucket's home region (SetBucketLogging is region-scoped).
4. If logging is desired, enable it once out-of-band via the console/ossutil instead of per-operation driver calls.
5. If transient, re-run — non-transient errors abort the artifact operation immediately.

Example fix

// before (controller/executor env)
ARGO_TRACE=1
// after
ARGO_TRACE=0  # or remove; alternatively grant oss:PutBucketLogging if tracing is required

// verify before enabling trace mode
if os.Getenv("ARGO_TRACE") == "1" {
	cli, _ := oss.New(endpoint, ak, sk)
	if err := cli.SetBucketLogging(bucketName, bucketName, "argo-trace", true); err != nil {
		log.Printf("bucket logging unavailable, disable ARGO_TRACE: %v", err)
	}
}

func isLoggingPermissionErr(err error) bool {
	se, ok := err.(oss.ServiceError)
	return ok && (se.Code == "AccessDenied" || se.Code == "NoSuchBucketLogging")
}

if err := driver.Save(ctx, path, artifact); err != nil {
	if strings.Contains(err.Error(), "failed to configure bucket logging") {
		log.Warn("ARGO_TRACE bucket logging failed; continuing without trace logging")
		os.Unsetenv("ARGO_TRACE") // fall back to non-traced operation
	}
}

When it happens

Trigger: Env var ARGO_TRACE=1 (wfcommon.EnvVarArgoTrace) on the workflow controller/executor plus a SetBucketLogging failure: RAM principal lacks oss:PutBucketLogging, bucket owned by another account, or endpoint/region mismatch.

Common situations: Enabling debug tracing in a cluster whose artifact credentials are scoped read/write-object only (no bucket-config permissions); locked-down production buckets where logging config is forbidden by RAM policy; hardening setups where ARGO_TRACE was left on from debugging.

Related errors

• mkdir %s error: %w
• failed to test if %s/%s is a directory: %w
• failed get directory: %w
• failed to check if bucket %s exists: %w
• failed to automatically create bucket %s when it's not prese

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/260441681372ffff. Report an issue: GitHub.