argoproj/argo-workflows · error

failed to create workflow: %w

Error message

failed to create workflow: %w

What it means

This error wraps the Kubernetes API error returned when the event dispatcher calls Workflows(ns).Create(ctx, wf) after successfully building and evaluating the Workflow from the EventBinding's referenced WorkflowTemplate. It means the Workflow object was constructed fine but the API server rejected or failed the creation (admission webhook, RBAC, name conflict, quota, invalid spec). The underlying Kubernetes error is preserved via %w.

Source

Thrown at server/event/dispatch/operation.go:166

				}
				program, compileErr := expr.Compile(p.ValueFrom.Event, expr.Env(o.env))
				if compileErr != nil {
					return nil, fmt.Errorf("failed to compile workflow template parameter %s expression: %w", p.Name, compileErr)
				}
				result, runErr := expr.Run(program, o.env)
				if runErr != nil {
					return nil, fmt.Errorf("failed to evaluate workflow template parameter \"%s\" expression: %w", p.Name, runErr)
				}
				data, marshalErr := json.Marshal(result)
				if marshalErr != nil {
					return nil, fmt.Errorf("failed to convert result to JSON \"%s\" expression: %w", p.Name, marshalErr)
				}
				wf.Spec.Arguments.Parameters = append(wf.Spec.Arguments.Parameters, wfv1.Parameter{Name: p.Name, Value: wfv1.AnyStringPtr(wfv1.Item{Value: data})})
			}
		}
		wf, err = client.ArgoprojV1alpha1().Workflows(wfeb.Namespace).Create(ctx, wf, metav1.CreateOptions{})
		if err != nil {
			return nil, fmt.Errorf("failed to create workflow: %w", err)
		}
		return wf, nil
	}
	return nil, nil
}

func (o *Operation) populateWorkflowMetadata(wf *wfv1.Workflow, metadata *metav1.ObjectMeta) error {
	if len(metadata.Name) > 0 {
		evalName, err := o.evaluateStringExpression(metadata.Name, "name")
		if err != nil {
			return err
		}
		wf.SetName(evalName)
	}
	if len(metadata.GenerateName) > 0 {
		evalName, err := o.evaluateStringExpression(metadata.GenerateName, "generateName")
		if err != nil {
			return err

View on GitHub (pinned to 35bff19146)

Solutions

1. Unwrap the %w error and read the Kubernetes reason: Forbidden -> fix RBAC (grant the argo-server SA 'create workflows' in the EventBinding namespace), AlreadyExists -> make metadata.name/generateName dynamic via an expression
2. If the name is static in workflowMetadata, change it to an expr like `workflow.name + '-' + (sprig.randAlpha(5))` or drop it to use generateName
3. Check ResourceQuota/LimitRange in the target namespace and raise it or free quota
4. For webhook/validation rejections, inspect the admission webhook message and shorten/fix labels, annotations, or the workflow spec
5. If transient (connection refused/timeout), verify the k8s API is reachable and add retry/backoff on the dispatch side

Example fix

// before: static name collides on repeat events
workflowMetadata:
  name: my-workflow
// after
workflowMetadata:
  generateName: my-workflow-
# or dynamic:
#   name: 'my-workflow-' + string(metadata.body.id)

// Pre-flight: check RBAC + name collision before dispatch
_, err := client.ArgoprojV1alpha1().Workflows(ns).List(ctx, metav1.ListOptions{
    FieldSelector: "metadata.name=" + desiredName})
if err == nil && len(items) > 0 { /* name exists — pick another */ }
// and verify: kubectl auth can-i create workflows.argoproj.io -n <ns> --as=system:serviceaccount:<ns>:argo-server

wf, err := client.ArgoprojV1alpha1().Workflows(ns).Create(ctx, wf, metav1.CreateOptions{})
if err != nil {
    switch {
    case kerrors.IsForbidden(err):
        // fix RBAC: grant create on workflows.argoproj.io in this namespace
    case kerrors.IsAlreadyExists(err):
        // switch to generateName or append a random suffix
    case kerrors.IsInvalid(err):
        // inspect details: fix labels/annotations/quota violations
    default:
        if !kerrors.IsTransientErr(ctx, err) { return err }
        // retry with backoff for transient API errors
    }
}

When it happens

Trigger: Any call to Create on the argoproj.io Workflows resource during event dispatch that returns a non-nil error: 403 RBAC denial for the event dispatcher's service account, admission webhook rejection (e.g. invalid generated name, invalid labels/annotations from workflowMetadata or evaluated metadata expressions), exceeded ResourceQuota, already-existing workflow name when metadata.name was set to a fixed value, or transient API server/connection failure.

Common situations: EventBus/EventBinding set up but the argo-server/controller service account lacks create-workflow RBAC in the binding's namespace; user set workflowMetadata name to a static string so a second event collides (AlreadyExists); namespace has a ResourceQuota; a validating webhook (policy) rejects the generated labels/annotations as too long or invalid.

Related errors

• failed to create cluster workflow template: %s, %w
• failed to list SSO RBAC service accounts: %w
• failed to get workflow template: %w
• failed to check if secret %s exists: %w
• failed to get token volumes: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/e0265849e6495bab. Report an issue: GitHub.