Controller ClusterRole missing permissions #13341
Labels
area/agent
Argo Agent that runs for HTTP and Plugin templates
area/controller
Controller issues, panics
area/manifests
area/templates/http
type/bug
type/regression
Regression from previous behavior (a specific type of bug)
type/support
User support issue - likely not a bug
Milestone
Comments
agilgur5
changed the title
I think you meant this file? The Controller ClusterRole?
It looks like Tim responded in your PR rather: argoproj/argo-helm#2825 (comment)
Are you sure that was in your Controller, and not in the workflow's own Pod? In your Helm issue, you pointed to the workflow role; that is the SA attached to Pods started by a workflow. And indeed the agent communicates its status to the Controller that way. I don't believe the Controller otherwise needs that permission.
|
agilgur5
added
area/templates/http
area/agent
|
I reproduced the issue again. When i remove this permission from the ClusterRole argo-workflows-workflow-controller: - apiGroups:
- argoproj.io
resources:
- workflowtasksets/status
- workflowartifactgctasks/status
verbs:
- patchI see the errors in the workflow-controller pod: And the tasks with HTTP-Template lasts very long: And the jobs last for round about 30 seconds: I've installed Argo-Workflows via Helm-Chart with this values: server:
extraArgs:
- --auth-mode=sso
- --auth-mode=client
sso:
enabled: true
issuer: <private-value>
clientId:
name: dex-credentials
key: gitlabClientId
clientSecret:
name: dex-credentials
key: gitlabClientSecret
redirectUrl: <private-value>
rbac:
enabled: false
controller:
workflowNamespaces:
- argocd
workflowDefaults:
spec:
serviceAccountName: argo-workflowAfter installing the Chart I create the Role, RoleBinding and ServiceAccount for the workflow-worker via a manifest: # These configuration is needed to give workflows workers to cluster objects.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: argo-workflow
namespace: argocd
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- watch
- patch
- apiGroups:
- ""
resources:
- pods/log
verbs:
- get
- watch
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- apiGroups:
- argoproj.io
resources:
- workflowtaskresults
verbs:
- create
- patch
- apiGroups:
- argoproj.io
resources:
- workflowtasksets
- workflowartifactgctasks
verbs:
- list
- watch
- apiGroups:
- argoproj.io
resources:
- workflowtasksets/status
- workflowartifactgctasks/status
verbs:
- patch
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: argo-workflow
namespace: argocd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: argo-workflows-workflow
namespace: argocd
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: argo-workflow
subjects:
- kind: ServiceAccount
name: argo-workflow
namespace: argocd
---
# As of Kubernetes v1.24, secrets are no longer automatically created for service accounts.
# See: https://argo-workflows.readthedocs.io/en/latest/service-account-secrets/
apiVersion: v1
kind: Secret
metadata:
name: argo-workflow.service-account-token
namespace: argocd
annotations:
kubernetes.io/service-account.name: argo-workflow
type: kubernetes.io/service-account-tokenI hope this helps to clarify the issue. Regards, |
agilgur5
removed
the
problem/more information needed
4 tasks
agilgur5
added
type/regression
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Pre-requisites
:latestimage tag (i.e.quay.io/argoproj/workflow-controller:latest) and can confirm the issue still exists on:latest. If not, I have explained why, in detail, in my description below.What happened? What did you expect to happen?
Describe the bug
Hi,
I have a problem with Argo workflows HTTP Template. When I run a workflow with using this template, the workflow lasts for 30 seconds or many minutes until it is finished. I researched the behavior and found an error message in the workflow-controller pod:
I've installed Argo workflows using the latest Helm-Chart. After I investigated the issue, i found missing permission in the ClusterRole for the workflow-controller.
After adding this rule to the ClusterRole on my cluster, all HTTP Template jobs are running perfectly fine. I've opened an issue at the Helm-Chart repo (argoproj/argo-helm#2824) and they pointed out to me that the permission is missed in the "manifests/cluster-install/argo-server-rbac/argo-server-clusterole.yaml" file, too. Is it possible that these permissions are missing? Or did I some misconfiguration in my cluster? I'm a little confused that this issue should only happen on my site.
Thank you so much for helping.
Version(s)
v3.5.8
Paste a minimal workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.
Logs from the workflow controller
Logs from in your workflow's wait container
The text was updated successfully, but these errors were encountered: