argoproj/argo-workflows · error

failed to read bearer token file: %w

Error message

failed to read bearer token file: %w

What it means

ClaimSetWithBearerToken needed to read the bearer token from disk (restConfig.BearerTokenFile) because no inline token was set, and os.ReadFile failed. The SA-token file is missing or unreadable in the argo-server container.

Source

Thrown at server/auth/serviceaccount/claims.go:40

	}

	if restConfig.BearerToken != "" || restConfig.BearerTokenFile != "" {
		return ClaimSetWithBearerToken(restConfig)
	}

	if restConfig.CertFile != "" || len(restConfig.CertData) > 0 {
		return ClaimSetWithX509(restConfig)
	}
	return nil, nil
}

func ClaimSetWithBearerToken(restConfig *rest.Config) (*types.Claims, error) {
	bearerToken := restConfig.BearerToken
	if bearerToken == "" {
		// should only ever be used for service accounts
		data, err := os.ReadFile(restConfig.BearerTokenFile)
		if err != nil {
			return nil, fmt.Errorf("failed to read bearer token file: %w", err)
		}
		bearerToken = string(data)
	}

	parts := strings.SplitN(bearerToken, ".", 3)
	if len(parts) != 3 {
		return nil, fmt.Errorf("expected bearer token to be a JWT and therefore have 3 dot-delimited parts")
	}
	payload := parts[1]
	data, err := base64.RawStdEncoding.DecodeString(payload)
	if err != nil {
		return nil, fmt.Errorf("failed to decode bearer token's JWT payload: %w", err)
	}

	claims := &types.Claims{}
	err = json.Unmarshal(data, &claims)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal bearer token's JWT payload: %w", err)

View on GitHub (pinned to 35bff19146)

Solutions

1. Verify the service account token file is mounted at the configured path
2. Check file permissions for the argo-server process

When it happens

Trigger: Thrown at server/auth/serviceaccount/claims.go:40 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/9f959844e1fedf17. Report an issue: GitHub.