workflow-controller-configmap.yaml

# This file describes the config settings available in the workflow controller configmap
apiVersion: v1
kind: ConfigMap
metadata:
  name: workflow-controller-configmap
data:
  config: |   # This is optional in v2.7+, see docs/workflow-controller-configmap.md
    # instanceID is a label selector to limit the controller's watch to a specific instance. It
    # contains an arbitrary value that is carried forward into its pod labels, under the key
    # workflows.argoproj.io/controller-instanceid, for the purposes of workflow segregation. This
    # enables a controller to only receive workflow and pod events that it is interested about,
    # in order to support multiple controllers in a single cluster, and ultimately allows the
    # controller itself to be bundled as part of a higher level application. If omitted, the
    # controller watches workflows and pods that *are not* labeled with an instance id.
    instanceID: my-ci-controller

    # Parallelism limits the max total parallel workflows that can execute at the same time
    # (available since Argo v2.3). Controller must be restarted to take effect.
    parallelism: 10

    # Whether or not to emit events on node completion. These can take a up a lot of space in
    # k8s (typically etcd) resulting in errors when trying to create new events:
    # "Unable to create audit event: etcdserver: mvcc: database space exceeded"
    # This config item allows you to disable this.
    # (since v2.9)
    nodeEvents:
      enabled: true

    # uncomment flowing lines if workflow controller runs in a different k8s cluster with the
    # workflow workloads, or needs to communicate with the k8s apiserver using an out-of-cluster
    # kubeconfig secret
    # kubeConfig:
    #   # name of the kubeconfig secret, may not be empty when kubeConfig specified
    #   secretName: kubeconfig-secret
    #   # key of the kubeconfig secret, may not be empty when kubeConfig specified
    #   secretKey: kubeconfig
    #   # mounting path of the kubeconfig secret, default to /kube/config
    #   mountPath: /kubeconfig/mount/path
    #   # volume name when mounting the secret, default to kubeconfig
    #   volumeName: kube-config-volume

    links:
      - name: Example Workflow Link
        scope: workflow
        url: http:https://logging-facility?namespace=${metadata.namespace}&workflowName=${metadata.name}&startedAt=${status.startedAt}&finishedAt=${status.finishedAt}
      - name: Example Pod Link
        scope: pod
        url: http:https://logging-facility?namespace=${metadata.namespace}&podName=${metadata.name}&startedAt=${status.startedAt}&finishedAt=${status.finishedAt}

    # artifactRepository defines the default location to be used as the artifact repository for
    # container artifacts.
    artifactRepository:
      # archiveLogs will archive the main container logs as an artifact
      archiveLogs: true

      s3:
        # Use the corresponding endpoint depending on your S3 provider:
        #   AWS: s3.amazonaws.com
        #   GCS: storage.googleapis.com
        #   Minio: my-minio-endpoint.default:9000
        endpoint: s3.amazonaws.com
        bucket: my-bucket
        region: us-west-2
        # insecure will disable TLS. Primarily used for minio installs not configured with TLS
        insecure: false
        # keyFormat is a format pattern to define how artifacts will be organized in a bucket.
        # It can reference workflow metadata variables such as workflow.namespace, workflow.name,
        # pod.name. Can also use strftime formating of workflow.creationTimestamp so that workflow
        # artifacts can be organized by date. If omitted, will use `{{workflow.name}}/{{pod.name}}`,
        # which has potential for have collisions.
        # The following example pattern organizes workflow artifacts under a "my-artifacts" sub dir,
        # then sub dirs for year, month, date and finally workflow name and pod.
        # e.g.: my-artifacts/2018/08/23/my-workflow-abc123/my-workflow-abc123-1234567890
        keyFormat: "my-artifacts\
          /{{workflow.creationTimestamp.Y}}\
          /{{workflow.creationTimestamp.m}}\
          /{{workflow.creationTimestamp.d}}\
          /{{workflow.name}}\
          /{{pod.name}}"
        # The actual secret object (in this example my-s3-credentials), should be created in every
        # namespace where a workflow needs to store its artifacts to S3. If omitted,
        # attempts to use IAM role to access the bucket (instead of accessKey/secretKey).
        accessKeySecret:
          name: my-s3-credentials
          key: accessKey
        secretKeySecret:
          name: my-s3-credentials
          key: secretKey
        # If this is set to true, argo workflows will use AWS SDK default credentials provider chain. This will allow things like
        # IRSA and any of the authentication methods that the golang SDK uses in it's default chain.
        useSDKCreds: false

    # Specifies the container runtime interface to use (default: docker)
    # must be one of: docker, kubelet, k8sapi, pns
    containerRuntimeExecutor: docker

    # Specifies the location of docker.sock on the host for docker executor (default: /var/run/docker.sock)
    # (available since Argo v2.4)
    dockerSockPath: /var/someplace/else/docker.sock

    # kubelet port when using kubelet executor (default: 10250)
    kubeletPort: 10250

    # disable the TLS verification of the kubelet executor (default: false)
    kubeletInsecure: false

    # executor controls how the init and wait container should be customized
    # (available since Argo v2.3)
    executor:
      imagePullPolicy: IfNotPresent
      resources:
        requests:
          cpu: 0.1
          memory: 64Mi
        limits:
          cpu: 0.5
          memory: 512Mi
      # args & env allows command line arguments and environment variables to be appended to the
      # executor container and is mainly used for development/debugging purposes.
      args:
      - --loglevel
      - debug
      - --gloglevel
      - "6"
      env:
      # ARGO_TRACE enables some tracing information for debugging purposes. Currently it enables
      # logging of S3 request/response payloads (including auth headers)
      - name: ARGO_TRACE
        value: "1"

    # metricsConfig controls the path and port for prometheus metrics. Metrics are enabled and emitted on localhost:9090/metrics
    # by default.
    metricsConfig:
      # Enabled controls metric emission. Default is true, set "enabled: false" to turn off
      enabled: true
      # Path is the path where metrics are emitted. Must start with a "/". Default is "/metrics"
      path: /metrics
      # Port is the port where metrics are emitted. Default is "9090"
      port: 8080
      # MetricsTTL sets how often custom metrics are cleared from memory. Default is "0", metrics are never cleared
      metricsTTL: "10m"
      # IgnoreErrors is a flag that instructs prometheus to ignore metric emission errors. Default is "false"
      ignoreErrors: false

      # DEPRECATED: Legacy metrics are now removed, this field is ignored
      disableLegacy: false

    # telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint
    # as metrics by default, but can be overridden using this config.
    telemetryConfig:
      enabled: true
      path: /telemetry
      port: 8080

    # enable persistence using postgres
    persistence:
      connectionPool:
        maxIdleConns: 100
        maxOpenConns: 0
        connMaxLifetime: 0s # 0 means connections don't have a max lifetime
      #  if true node status is only saved to the persistence DB to avoid the 1MB limit in etcd
      nodeStatusOffLoad: false
      # save completed workloads to the workflow archive
      archive: false
      # the number of days to keep archived workflows (the default is forever)
      archiveTTL: 180d

      # LabelSelector determines the workflow that matches with the matchlabels or matchrequirements, will be archived.
      # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
      archiveLabelSelector:
        matchLabels:
          workflows.argoproj.io/archive-strategy: "always"

      # Optional name of the cluster I'm running in. This must be unique for your cluster.
      clusterName: default
      postgresql:
        host: localhost
        port: 5432
        database: postgres
        tableName: argo_workflows
        # the database secrets must be in the same namespace of the controller
        userNameSecret:
          name: argo-postgres-config
          key: username
        passwordSecret:
          name: argo-postgres-config
          key: password
        ssl: true
        # sslMode must be one of: disable, require, verify-ca, verify-full
        # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
        sslMode: require

      # Optional config for mysql:
      # mysql:
      #   host: localhost
      #   port: 3306
      #   database: argo
      #   tableName: argo_workflows
      #   userNameSecret:
      #     name: argo-mysql-config
      #     key: username
      #   passwordSecret:
      #     name: argo-mysql-config
      #     key: password

    # Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level
    # See more: docs/default-workflow-specs.md
    workflowDefaults:
      metadata:
        annotations:
          argo: workflows
        labels:
          foo: bar
      spec:
        ttlStrategy:
          secondsAfterSuccess: 5
        parallelism: 3

    # SSO Configuration for the Argo server.
    # You must also start argo server with `--auth-mode sso`.
    # https://argoproj.github.io/argo/argo-server-auth-mode/
    sso:
      # This is the root URL of the OIDC provider (required).
      issuer: https://issuer.root.url/
      # This is name of the secret and the key in it that contain OIDC client
      # ID issued to the application by the provider (required).
      clientId:
        name: client-id-secret
        key: client-id-key
      # This is name of the secret and the key in it that contain OIDC client
      # secret issued to the application by the provider (required).
      clientSecret:
        name: client-secret-secret
        key: client-secret-key
      # This is the redirect URL supplied to the provider (required). It must
      # be in the form <argo-server-root-url>/oauth2/callback. It must be
      # browser-accessible.
      redirectUrl: https://argo-server/oauth2/callback
      # Additional scopes to request. Typically needed for SSO RBAC. >= v2.12
      scopes:
       - groups
       - email
      # RBAC Config. >= v2.12
      rbac:
        enabled: false
    # workflowRequirements restricts the Workflows that the controller will process.
    # Current options:
    #   referenceOnly: Only Workflows using "workflowTemplateRef" will be processed. This allows the administrator of the controller
    #     to set a "library" of templates that may be run by its operator, limiting arbitrary Workflow execution.
    #   strictReferenceOnly: Only Workflows using "workflowTemplateRef" will be processed and the controller will enforce
    #     that the WorkflowTemplate that is referenced hasn't changed between operations. If you want to make sure the operator of the
    #     Workflow cannot run an arbitrary Workflow, use this option.
    workflowRequirements:
      referenceOnly: true