argoproj/argo-workflows · error

only one of azureToken or awsRDSToken may be enabled, not bo

Error message

only one of azureToken or awsRDSToken may be enabled, not both

What it means

createPostGresDBSession supports two cloud IAM token-auth modes for PostgreSQL: Azure (azureToken) and AWS RDS IAM (awsRDSToken). The config enables both simultaneously, which is ambiguous and unsupported, so session creation fails immediately.

Source

Thrown at util/sqldb/sqldb.go:72

		}
		return session, Postgres, err
	} else if dbConfig.MySQL != nil {
		session, err := createMySQLDBSessionWithCreds(dbConfig.MySQL, dbConfig.ConnectionPool, username, password, dbConfig.ConnectionTimeout())
		if err != nil {
			return nil, Invalid, err
		}
		return session, MySQL, err
	}
	return nil, "", fmt.Errorf("no databases are configured")
}

// createPostGresDBSession creates postgresDB session
func createPostGresDBSession(ctx context.Context, kubectlConfig kubernetes.Interface, namespace string, cfg *config.PostgreSQLConfig, persistPool *config.ConnectionPool, connectTimeout time.Duration) (db.Session, error) {
	azureEnabled := cfg.AzureToken != nil && cfg.AzureToken.Enabled
	awsEnabled := cfg.AWSRDSToken != nil && cfg.AWSRDSToken.Enabled

	if azureEnabled && awsEnabled {
		return nil, fmt.Errorf("only one of azureToken or awsRDSToken may be enabled, not both")
	}

	if awsEnabled && !cfg.SSL {
		return nil, fmt.Errorf("SSL must be enabled (ssl: true) when using AWS RDS IAM authentication")
	}

	userNameByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.UsernameSecret.Name, cfg.UsernameSecret.Key)
	if err != nil {
		return nil, err
	}

	if azureEnabled {
		return createPostGresDBSessionWithAzure(cfg, persistPool, string(userNameByte), connectTimeout)
	}

	if awsEnabled {
		return createPostGresDBSessionWithAWSRDS(cfg, persistPool, string(userNameByte), connectTimeout)
	}

View on GitHub (pinned to 35bff19146)

Solutions

1. Remove the azureToken block or set azureToken.enabled: false if you intend AWS RDS IAM auth.
2. Remove the awsRDSToken block or set awsRDSToken.enabled: false if you intend Azure token auth.
3. Restart the controller/server after fixing the configmap so the new config is loaded.

Example fix

# before
postgresql:
  azureToken:
    enabled: true
  awsRDSToken:
    enabled: true
# after
postgresql:
  awsRDSToken:
    enabled: true

pg := dbConfig.PostgreSQL
azureOn := pg != nil && pg.AzureToken != nil && pg.AzureToken.Enabled
awsOn := pg != nil && pg.AWSRDSToken != nil && pg.AWSRDSToken.Enabled
if azureOn && awsOn {
	return errors.New("disable either azureToken or awsRDSToken, not both")
}

_, _, err := sqldb.CreateDBSession(ctx, kubectlConfig, namespace, dbConfig)
if err != nil && strings.Contains(err.Error(), "only one of azureToken or awsRDSToken") {
	return fmt.Errorf("config error: pick one cloud IAM token provider: %w", err)
}

When it happens

Trigger: DBConfig.PostgreSQL has azureToken.enabled: true AND awsRDSToken.enabled: true at the same time when CreateDBSession creates the postgres session.

Common situations: Merging config fragments where each fragment enabled its own cloud token; leftover awsRDSToken block from a migration to Azure (or vice versa); copy-pasted example config containing both blocks.

Related errors

• SSL must be enabled (ssl: true) when using AWS RDS IAM authe
• no databases are configured
• unsupported db type %s
• failed to load AWS config: %w
• failed to obtain a credential: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/e722ec0fbcaca4e7. Report an issue: GitHub.