failed to unmarshall config map key %q for artifact reposito

Error message

failed to unmarshall config map key %q for artifact repository ref "%v": %w

What it means

The ConfigMap key was found, but its string value failed to unmarshal (sigs.k8s.io/yaml) into a wfv1.ArtifactRepository struct. The wrapped yaml error names the offending field/type. The value must be valid YAML matching the ArtifactRepository schema (e.g. an s3:, gcs:, or other backend block).

Source

Thrown at workflow/artifactrepositories/artifactrepositories.go:103

	var cm *v1.ConfigMap
	namespace := ref.Namespace
	configMap := ref.GetConfigMapOr("artifact-repositories")
	err := waitutil.Backoff(retry.DefaultRetry(ctx), func() (bool, error) {
		var err error
		cm, err = s.kubernetesInterface.CoreV1().ConfigMaps(namespace).Get(ctx, configMap, metav1.GetOptions{})
		return !errorsutil.IsTransientErrQuiet(ctx, err), err
	})
	if err != nil {
		return nil, err
	}
	key := ref.GetKeyOr(cm.Annotations["workflows.argoproj.io/default-artifact-repository"])
	value, ok := cm.Data[key]
	if !ok {
		return nil, fmt.Errorf(`config map missing key "%s" for artifact repository ref "%v"`, key, ref)
	}
	repo := &wfv1.ArtifactRepository{}
	if err := yaml.Unmarshal([]byte(value), repo); err != nil {
		return nil, fmt.Errorf(`failed to unmarshall config map key %q for artifact repository ref "%v": %w`, key, ref, err)
	}
	// we need the fully filled out ref so we can store it in the workflow status and it will never change
	// (even if the config map default annotation is changed)
	// this means users can change the default
	return &wfv1.ArtifactRepositoryRefStatus{
		Namespace:             namespace,
		ArtifactRepositoryRef: wfv1.ArtifactRepositoryRef{ConfigMap: configMap, Key: key},
		ArtifactRepository:    repo,
	}, nil
}

View on GitHub (pinned to 35bff19146)

Solutions

Read the wrapped yaml error after the colon to find the exact offending line/field
Fix the key's value to be valid YAML matching ArtifactRepository schema (see docs/fields.md for s3/gcs/azure/oss shapes)
Replace tabs with spaces and validate the YAML (yamllint) before applying the ConfigMap
Check the Argo version's expected schema if fields were renamed in an upgrade

Example fix

# before (invalid: scalar instead of mapping)
s3: my-bucket
# after
s3:
  bucket: my-bucket
  endpoint: s3.amazonaws.com
  insecure: true

Defensive patterns

Strategy: validation

Validate before calling

func validArtifactRepoYAML(s string) error {
    var repo wfv1.ArtifactRepository
    if err := yaml.Unmarshal([]byte(s), &repo); err != nil {
        return fmt.Errorf("invalid ArtifactRepository YAML: %w", err)
    }
    return nil
}
// run for every key in artifact-repositories before the controller uses it

Try / catch

_, err := repos.Get(ctx, ref)
if err != nil && strings.Contains(err.Error(), "failed to unmarshall config map key") {
    return fmt.Errorf("artifact-repositories ConfigMap value is malformed: %w", err)
}

Prevention

Validate ConfigMap values with yamllint / a schema check before kubectl apply
Use spaces, never tabs, in embedded YAML values
Match the documented ArtifactRepository schema (s3:/gcs: etc. as mappings, not scalars)
Add a unit/CI test that unmarshals every key of the artifact-repositories ConfigMap

When it happens

Trigger: s.get unmarshals cm.Data[key] into &wfv1.ArtifactRepository{} and yaml.Unmarshal fails — value is plain text instead of YAML, has wrong types (e.g. bucket as a number/list), unknown incompatible structure, or invalid YAML syntax (tabs, bad indentation).

Common situations: Pasting JSON-ish or prose into the ConfigMap entry; using tabs instead of spaces in the YAML; specifying a backend field with the wrong shape (e.g. s3: mybucket instead of a mapping); schema drift after an Argo version upgrade changing field names.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/9267918afde3fea5. Report an issue: GitHub.