feat(argo-workflows): Allow controller to whitelist secrets

[emmayylu]

Allow the controller to get any secrets.

When I was working with argo events, I created the following objects:

• an argo workflow that uses service account A
• service account A using mimagePullSecret docker-registry

The argo events sensor get an error when triggering the workflow. The error is secrets "docker-registry" is forbidden: User "system:serviceaccount:argo:my-argo-workflows-workflow-controller" cannot get resource "secrets" in API group "" in the namespace "yolu-ci"'

The error happens because the service account that the controller is using does not have permission to get secrets. This PR allows users to whitelist secrets. After making this change, the error is gone

Signed-off-by: emmayylu 84873428+yolu-kxs@users.noreply.github.com

Note on DCO:

If the DCO action in the integration test fails, one or more of your commits are not signed off. Please click on the Details link next to the DCO action for instructions on how to resolve this.

Checklist:

• I have bumped the chart version according to versioning
• I have updated the documentation according to documentation
• I have updated the chart changelog with all the changes that come with this pull request according to changelog.
• Any new values are backwards compatible and/or have sensible default.
• I have signed off all my commits as required by DCO.
• My build is green (troubleshooting builds).

Changes are automatically published when merged to main. They are not published on branches.

[yu-croco]

[IMO]
Many of organizations/companies want to restrict secret access, so I think we need to keep this resourceNames block. 🤔
Instead of allowing all secret access, maybe we can add new block, like below.
*Same logic is implemented here

# charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml
{{- if .Values.controller.secretWhitelist }}
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  {{- with .Values.controller.secretWhitelist }}
  resourceNames: {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}

WDYT? 👀 @stefansedich @paguos @vladlosev @yann-soubeyrand @jmeridth

[vladlosev]

@yu-croco I think this solution makes sense. The code can be simplified slightly, though:

{{- with .Values.controller.secretWhitelist }}
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  resourceNames: {{- toYaml . | nindent 4 }}
{{- end }}

[yu-croco]

Thank you for checking, @vladlosev .
You're right, that's perfect. 👍

Hi @emmayylu @yolu-kxs , thank you for your contribution.
Could you please add new block ( #1646 (comment) ), instead of removing existing resourceNames ? 🙋
*I can take over it, so please feel free to ask me if you want to.

[emmayylu]

Thank you for checking, @vladlosev . You're right, that's perfect. 👍

Hi @emmayylu @yolu-kxs , thank you for your contribution. Could you please add new block ( #1646 (comment) ), instead of removing existing resourceNames ? 🙋 *I can take over it, so please feel free to ask me if you want to.

Thank you! I've updated the PR.

[yu-croco]

Thank you for your contribution! LGTM