argoproj/argo-workflows · error

%w

Error message

%w

What it means

The `argoexec resource` cobra command wraps any error from execResource with fmt.Errorf("%w", err). It is a transparent wrapper adding no message text; the underlying cause (a kubectl apply/get/delete failure on the managed resource) is preserved via %w. The real error comes from applying or waiting on a Kubernetes resource manifest in the resource template.

Source

Thrown at cmd/argoexec/commands/resource.go:24

	"github.com/spf13/cobra"

	"github.com/argoproj/argo-workflows/v4/util/logging"
	"github.com/argoproj/argo-workflows/v4/workflow/common"

	"github.com/argoproj/argo-workflows/v4/cmd/argoexec/executor"
	"github.com/argoproj/argo-workflows/v4/workflow/executor/tracing"
)

func NewResourceCommand() *cobra.Command {
	command := cobra.Command{
		Use:   "resource (get|create|apply|delete) MANIFEST",
		Short: "update a resource and wait for resource conditions",
		Args:  cobra.ExactArgs(1),
		RunE: func(cmd *cobra.Command, args []string) error {
			err := execResource(cmd.Context(), args[0])
			if err != nil {
				return fmt.Errorf("%w", err)
			}
			return nil
		},
	}
	return &command
}

//nolint:contextcheck
func execResource(ctx context.Context, action string) error {
	ctx = tracing.InjectTraceContext(ctx)
	wfExecutor := executor.Init(ctx, clientConfig, varRunArgo)
	defer func() {
		if err := wfExecutor.Tracing.Shutdown(context.WithoutCancel(ctx)); err != nil {
			logging.RequireLoggerFromContext(ctx).WithError(err).Error(ctx, "Failed to shutdown tracing")
		}
	}()

	// Don't allow cancellation to impact capture of results, parameters, artifacts, or defers.

View on GitHub (pinned to 35bff19146)

Solutions

1. Inspect the wrapped underlying error for the concrete k8s API failure
2. Validate the manifest locally with `kubectl apply --dry-run=client`
3. Grant the workflow service account RBAC rules for the resource kinds being managed
4. Confirm the target CRD/API version exists on the cluster

// pre-validate the manifest outside the workflow:
// kubectl apply --dry-run=client -f manifest.yaml
// kubectl auth can-i create <resource> --as=system:serviceaccount:ns:wf-sa

// unwrap to classify the k8s API error
err := execResource(ctx, manifest)
if err != nil {
    var se *apierrors.StatusError
    if errors.As(err, &se) {
        // inspect se.ErrStatus.Reason: Forbidden / NotFound / Invalid
    }
}

When it happens

Trigger: Running `argoexec resource <verb> <manifest>` where execResource fails — kubectl-style apply fails due to invalid manifest YAML, RBAC denial for the workflow service account, API server unreachable, or a waited-for condition never becomes true.

Common situations: Resource templates whose manifests reference CRDs not installed on the cluster; missing RBAC permissions for the pod's service account; wrong apiVersion in the manifest; cluster API server transiently unavailable.

Related errors

• %w
• successCondition, failureCondition and outputs are not suppo
• %w
• failed to write template: %w
• failed to stage files: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/244334fabef45c69. Report an issue: GitHub.