What causes "failure to create dynamic client: %w" in argoproj/argo-workflows?

Inspect the wrapped error (%w) for the underlying rest.Config problem and fix the kubeconfig/host/TLS settings

failure to create dynamic client: %w

Error message

failure to create dynamic client: %w

What it means

newArgoKubeClient builds a dynamic Kubernetes client from the caller's rest.Config. If dynamic.NewForConfig fails (bad host, malformed URL, invalid TLS settings, unusable transport config), the error is wrapped as "failure to create dynamic client". This happens before any network call, so it indicates a bad rest.Config, not connectivity.

Source

Thrown at pkg/apiclient/argo-kube-client.go:91

	cwfTmplStore      types.ClusterWorkflowTemplateStore
	wfLister          store.WorkflowLister
	wfStore           store.WorkflowStore
	namespace         string
	kubeClient        *kubernetes.Clientset
}

var _ Client = &argoKubeClient{}

func newArgoKubeClient(ctx context.Context, opts ArgoKubeOpts, clientConfig clientcmd.ClientConfig, instanceIDService instanceid.Service) (context.Context, Client, error) {
	restConfig, err := clientConfig.ClientConfig()
	if err != nil {
		return nil, nil, err
	}
	version := argo.GetVersion()
	restConfig = restclient.AddUserAgent(restConfig, fmt.Sprintf("argo-workflows/%s argo-api-client", version.Version))
	dynamicClient, err := dynamic.NewForConfig(restConfig)
	if err != nil {
		return nil, nil, fmt.Errorf("failure to create dynamic client: %w", err)
	}
	wfClient, err := workflow.NewForConfig(restConfig)
	if err != nil {
		return nil, nil, err
	}
	namespace, _, err := clientConfig.Namespace()
	if err != nil {
		return nil, nil, err
	}
	eventInterface, err := events.NewForConfig(restConfig)
	if err != nil {
		return nil, nil, err
	}
	kubeClient, err := kubernetes.NewForConfig(restConfig)
	if err != nil {
		return nil, nil, err
	}
	clients := &types.Clients{

View on GitHub (pinned to 35bff19146)

Solutions

Inspect the wrapped error (%w) for the underlying rest.Config problem and fix the kubeconfig/host/TLS settings
Test that kubectl works with the same KUBECONFIG
If not using direct-kube, set ArgoServerOpts.URL so the kube client is never constructed

Example fix

// before (bad kubeconfig)
server: "https://my-cluster"  # missing port/scheme details, bad CA
// after
export KUBECONFIG=/path/to/valid/config && kubectl cluster-info  # verify first, then rerun argo

Defensive patterns

Strategy: try-catch

Validate before calling

restCfg, err := clientConfig.ClientConfig()
if err != nil { return err }
if restCfg.Host == "" { return errors.New("empty API host in rest.Config") }
// sanity probe
probe, err := kubernetes.NewForConfig(restCfg)
if err != nil { return fmt.Errorf("rest.Config invalid: %w", err) }
_, err = probe.Discovery().ServerVersion()

Try / catch

client, err := apiclient.NewAPIClient(ctx, opts)
if err != nil {
    if strings.Contains(err.Error(), "failure to create dynamic client") {
        return fmt.Errorf("check KUBECONFIG/rest.Config validity: %w", err)
    }
    return err
}

Prevention

Verify kubectl works with the same kubeconfig before running argo tooling
Regenerate service account tokens/CA bundles that may have expired
Never hand-edit certificate data in kubeconfigs; use kubectl config set-credentials

When it happens

Trigger: NewClientFromOptsWithContext with direct-kube transport where clientConfig.ClientConfig yields a malformed rest.Config — wrong ARGO_SERVER host format, invalid certificate/CA data in KUBECONFIG, or a clientConfig whose Namespace()/host fields are unset.

Common situations: KUBECONFIG pointing to a cluster with a broken/mis-encoded CA or client cert; ARGO_SERVER env var set to something unparseable; running outside a cluster without a valid kubeconfig (missing ~.kube/config).

Related errors

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/2a03dccdd820f980. Report an issue: GitHub.