argoproj/argo-workflows · error

failed to list SSO RBAC service accounts: %w

Error message

failed to list SSO RBAC service accounts: %w

What it means

When SSO is enabled, the gatekeeper maps OIDC claims to a ServiceAccount by listing ServiceAccounts in the namespace through the informer cache and matching RBAC-rule annotations. If the cache lister fails, rbacAuthorization cannot proceed and returns 'failed to list SSO RBAC service accounts: <err>'. This is almost always a cache/informer or API connectivity problem, not a user permission issue.

Source

Thrown at server/auth/gatekeeper.go:235

	if req == nil {
		return ""
	}
	namespacedRequest, ok := req.(servertypes.NamespacedRequest)
	if !ok {
		return ""
	}
	return namespacedRequest.GetNamespace()
}

func precedence(serviceAccount *corev1.ServiceAccount) int {
	i, _ := strconv.Atoi(serviceAccount.Annotations[common.AnnotationKeyRBACRulePrecedence])
	return i
}

func (s *gatekeeper) getServiceAccount(claims *authTypes.Claims, namespace string) (*corev1.ServiceAccount, error) {
	list, err := s.cache.ServiceAccountLister.ServiceAccounts(namespace).List(labels.Everything())
	if err != nil {
		return nil, fmt.Errorf("failed to list SSO RBAC service accounts: %w", err)
	}
	var serviceAccounts []*corev1.ServiceAccount
	for _, serviceAccount := range list {
		_, ok := serviceAccount.Annotations[common.AnnotationKeyRBACRule]
		if !ok {
			continue
		}
		serviceAccounts = append(serviceAccounts, serviceAccount)
	}
	sort.Slice(serviceAccounts, func(i, j int) bool { return precedence(serviceAccounts[i]) > precedence(serviceAccounts[j]) })
	for _, serviceAccount := range serviceAccounts {
		rule := serviceAccount.Annotations[common.AnnotationKeyRBACRule]
		v, err := jsonutil.Jsonify(claims)
		if err != nil {
			return nil, fmt.Errorf("failed to marshall claims: %w", err)
		}
		allow, err := argoexpr.EvalBool(rule, v)
		if err != nil {

View on GitHub (pinned to 35bff19146)

Solutions

1. Retry the request — if the cache was still warming after startup, it will succeed once informers sync.
2. Check argo-server logs for informer/cache errors; restart the argo-server pod if the watch is broken.
3. Verify argo-server RBAC: the cluster role must allow `list` on `serviceaccounts` (and in namespaced mode, in the target namespace).
4. Confirm k8s API reachability from the argo-server pod (`kubectl exec` + curl the API server) and check for network policies blocking it.
5. If the error persists on every SSO request, check that the ServiceAccounts with `workflows.argoproj.io/rbac-rule` annotations exist in the SSO namespace.

Example fix

// before: minimal install role missing serviceaccount list
rules:
- apiGroups: ["argoproj.io"]
  resources: ["workflows"]
  verbs: ["get", "list"]
// after: allow SSO RBAC-rule mapping
rules:
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["argoproj.io"]
  resources: ["workflows"]
  verbs: ["get", "list"]

// before issuing the request, confirm cache readiness and RBAC
saList, err := kubeClient.CoreV1().ServiceAccounts(ssoNamespace).List(ctx, metav1.ListOptions{})
if err != nil {
    return fmt.Errorf("argo-server cannot list service accounts (check RBAC role): %w", err)
}

func isCacheListErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "failed to list SSO RBAC service accounts")
}

resp, err := client.GetWorkflow(ctx, req)
if err != nil && isCacheListErr(err) {
    time.Sleep(2 * time.Second) // allow informer cache to re-sync
    resp, err = client.GetWorkflow(ctx, req)
}

When it happens

Trigger: An SSO-authenticated request reaches rbacAuthorization while the informer cache is not yet synced, the informer watch to the Kubernetes API broke, the argo-server lacks RBAC permission to list service accounts in the target namespace (e.g. namespaced mode with a missing role), or the k8s API is unreachable/timeout.

Common situations: Requests right after argo-server startup before the ResourceCache syncs; network flaps or API server restarts; installing argo-server with an RBAC role missing `serviceaccounts: list` (custom minimal installs); heavy API load causing lister errors.

Related errors

• failed to get service account secret: %w
• failed to create secret: %w
• failed to read secret: %w
• failed to get workflow template: %w
• failed to check if secret %s exists: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/52647cae9003aa95. Report an issue: GitHub.