argo-workflows

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

images:

# -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`.

tag: ""

# -- imagePullPolicy to apply to all containers

pullPolicy: Always

# -- Secrets with credentials to pull images from a private registry

pullSecrets: []

# - name: argo-pull-secret

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.

# Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.

full: true

# -- Annotations to be added to all CRDs (only applies when crds.full=false)

annotations: {}

# Configuration for the CRD install Job (only used when crds.full=true)

upgradeJob:

# -- Image for the container that applies the full CRDs. It bundles the CRDs for its own tag, so keep it in step with the app version.

## Ref: https://argo-workflows.readthedocs.io/en/latest/crd-installer/

image:

# -- Registry to use for the CRD installer

registry: cgr.dev

# -- Repository to use for the CRD installer

repository: chainguard-private/kubectl

# -- Image tag for the CRD installer. Defaults to `.Values.images.tag`.

tag: 1.36.4@sha256:0a51594520b6c95e564fd8a8c54b6ad65a0588c7e601e7ecbd527bb025d2e3f8

# -- Resources for the CRD install Job containers

resources: {}

# -- Node selector for the CRD install Job

nodeSelector: {}

# -- Pod security context for the CRD install Job pod

podSecurityContext: {}

# -- Optional labels to add to the CRD install Job pod

podLabels: {}

# -- Tolerations for the CRD install Job

tolerations: []

# -- Image pull secrets for the CRD install Job

# @default -- `.Values.images.pullSecrets`

imagePullSecrets: []

# -- Security context for the CRD install Job container

securityContext:

readOnlyRootFilesystem: true

runAsNonRoot: true

allowPrivilegeEscalation: false

runAsUser: 8737

runAsGroup: 8737

seccompProfile:

type: RuntimeDefault

capabilities:

drop:

- ALL

# -- Extra environment variables to provide to the CRD install Job container

extraEnv: []

# -- Create ClusterRoles that extend existing ClusterRoles to interact with Argo Workflows CRDs.

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: true

# -- String to partially override "argo-workflows.fullname" template

nameOverride:

# -- String to fully override "argo-workflows.fullname" template

fullnameOverride:

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Labels to set on all resources

commonLabels: {}

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

apiVersionOverrides:

# -- String to override apiVersion of autoscaling rendered by this helm chart

autoscaling: "" # autoscaling/v2

# -- String to override apiVersion of GKE resources rendered by this helm chart

cloudgoogle: "" # cloud.google.com/v1

# -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart

monitoring: "" # monitoring.coreos.com/v1

# -- Restrict Argo to operate only in a single namespace (the namespace of the

# Helm release) by apply Roles and RoleBindings instead of the Cluster

# equivalents, and start workflow-controller with the --namespaced flag. Use it

# in clusters with strict access policy.

singleNamespace: false

workflow:

# -- Deprecated; use controller.workflowNamespaces instead.

namespace:

serviceAccount:

# -- Specifies whether a service account should be created

create: false

# -- Specifies whether a secret for each service account should be created

createSecret: false

# -- Labels applied to created service account

labels: {}

# -- Annotations applied to created service account

annotations: {}

# -- Service account which is used to run workflows

# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`

100

pullSecrets: []

101

rbac:

102

# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.

103

# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)

104

create: true

105

# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates

106

agentPermissions: false

107

# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc

108

artifactGC: false

109

# -- Extra service accounts to be added to the RoleBinding

110

serviceAccounts: []

111

# - name: my-service-account

112

# namespace: my-namespace

113

# -- Additional rules for the service account that runs the workflows.

114

rules: []

115

controller:

116

image:

117

# -- Registry to use for the controller

118

registry: cgr.dev

119

# -- Registry to use for the controller

120

repository: chainguard-private/argo-workflowcontroller

121

# -- Image tag for the workflow controller. Defaults to `.Values.images.tag`.

122

tag: 4.1.2@sha256:6c208b00fe293791f3a6242a45033328870aff8a133f6d0c2520e84add1cd906

123

# -- parallelism dictates how many workflows can be running at the same time

124

parallelism:

125

# -- Globally limits the rate at which pods are created.

126

# This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of

127

# parallel nodes.

128

resourceRateLimit: {}

129

# limit: 10

130

# burst: 1

131

132

rbac:

133

# -- Adds Role and RoleBinding for the controller.

134

create: true

135

# -- Allows controller to get, list, and watch certain k8s secrets

136

secretWhitelist: []

137

# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.

138

accessAllSecrets: false

139

# -- Allows controller to create and update ConfigMaps. Enables memoization feature

140

writeConfigMaps: false

141

configMap:

142

# -- Create a ConfigMap for the controller

143

create: true

144

# -- ConfigMap name

145

146

# -- ConfigMap annotations

147

annotations: {}

148

# -- Limits the maximum number of incomplete workflows in a namespace

149

namespaceParallelism:

150

# -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224

151

initialDelay:

152

# -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment

153

deploymentAnnotations: {}

154

# -- podAnnotations is an optional map of annotations to be applied to the controller Pods

155

podAnnotations: {}

156

# -- Optional labels to add to the controller pods

157

podLabels: {}

158

# -- SecurityContext to set on the controller pods

159

podSecurityContext: {}

160

# podPortName: http

161

metricsConfig:

162

# -- Enables prometheus metrics server

163

enabled: false

164

# -- Path is the path where metrics are emitted. Must start with a "/".

165

path: /metrics

166

# -- Frequency at which prometheus scrapes metrics

167

interval: 30s

168

# -- Port is the port where metrics are emitted

169

port: 9090

170

# -- How often custom metrics are cleared from memory

171

metricsTTL: ""

172

# -- Flag that instructs prometheus to ignore metric emission errors.

173

ignoreErrors: false

174

# -- Flag that use a self-signed cert for TLS

175

secure: false

176

# -- Container metrics port name

177

portName: metrics

178

# -- Service metrics port

179

servicePort: 8080

180

# -- Service metrics port name

181

servicePortName: metrics

182

# -- serviceMonitor scheme

183

scheme: http

184

# -- Flag to enable headless service

185

headlessService: false

186

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

187

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#honorlabels

188

honorLabels: false

189

# -- ServiceMonitor relabel configs to apply to samples before scraping

190

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig

191

relabelings: []

192

# -- ServiceMonitor metric relabel configs to apply to samples before ingestion

193

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint

194

metricRelabelings: []

195

# -- ServiceMonitor will add labels from the service to the Prometheus metric

196

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec

197

targetLabels: []

198

# -- Manipulate the metrics created by the workflow controller

199

## Ref: https://argo-workflows.readthedocs.io/en/latest/metrics/#modifiers

200

modifiers: {}

201

# -- the controller container's securityContext

202

securityContext:

203

readOnlyRootFilesystem: true

204

runAsNonRoot: true

205

allowPrivilegeEscalation: false

206

capabilities:

207

drop:

208

- ALL

209

# -- enable Workflow Archive to store the status of workflows. Postgres, MySQL (>= 5.7.8) and MariaDB (>= 10.2.7, requires Argo Workflows v4.1+) are available.

210

## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/

211

persistence: {}

212

# connectionPool:

213

# maxIdleConns: 100

214

# maxOpenConns: 0

215

# # save the entire workflow into etcd and DB

216

# nodeStatusOffLoad: false

217

# # enable archiving of old workflows

218

# archive: false

219

# postgresql:

220

# host: localhost

221

# port: 5432

222

# database: postgres

223

# tableName: argo_workflows

224

# # the database secrets must be in the same namespace of the controller

225

# userNameSecret:

226

# name: argo-postgres-config

227

# key: username

228

# passwordSecret:

229

# name: argo-postgres-config

230

# key: password

231

# # Instead of passwordSecret, Postgres can authenticate with a token.

232

# # Requires Argo Workflows v4.1+; userNameSecret is still required.

233

# # Microsoft Entra ID (needs Azure Workload Identity on the controller's service account):

234

# azureToken:

235

# enabled: true

236

# scope: https://ossrdbms-aad.database.windows.net/.default

237

# # AWS RDS IAM authentication (needs IRSA or EKS Pod Identity on the controller's service account):

238

# awsRDSToken:

239

# enabled: true

240

# region: us-east-1

241

# ssl: true

242

# # sslMode must be one of: disable, require, verify-ca, verify-full

243

# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq

244

# sslMode: require

245

# mysql:

246

# host: localhost

247

# port: 3306

248

# database: argo

249

# tableName: argo_workflows

250

# userNameSecret:

251

# name: argo-mysql-config

252

# key: username

253

# passwordSecret:

254

# name: argo-mysql-config

255

# key: password

256

257

# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.

258

# Only valid for 2.7+

259

## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/

260

workflowDefaults: {}

261

# spec:

262

# ttlStrategy:

263

# secondsAfterCompletion: 86400

264

# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/

265

# artifactRepositoryRef:

266

# configMap: my-artifact-repository # default is "artifact-repositories"

267

# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.

268

269

# -- Number of workflow workers

270

workflowWorkers: # 32

271

# -- Number of workflow TTL workers

272

workflowTTLWorkers: # 4

273

# -- Number of pod cleanup workers

274

podCleanupWorkers: # 4

275

# -- Number of cron workflow workers

276

# Only valid for 3.5+

277

cronWorkflowWorkers: # 8

278

# -- Restricts the Workflows that the controller will process.

279

# Only valid for 2.9+

280

workflowRestrictions: {}

281

# templateReferencing: Strict|Secure

282

283

# telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint

284

# as metrics by default, but can be overridden using this config.

285

telemetryConfig:

286

# -- Enables prometheus telemetry server

287

enabled: false

288

# -- telemetry path

289

path: /telemetry

290

# -- Frequency at which prometheus scrapes telemetry data

291

interval: 30s

292

# -- telemetry container port

293

port: 8081

294

# -- How often custom metrics are cleared from memory

295

metricsTTL: ""

296

# -- Flag that instructs prometheus to ignore metric emission errors.

297

ignoreErrors: false

298

# -- Flag that use a self-signed cert for TLS

299

secure: false

300

# -- telemetry service port

301

servicePort: 8081

302

# -- telemetry service port name

303

servicePortName: telemetry

304

# -- telemetry serviceMonitor scheme to use

305

scheme: http

306

serviceMonitor:

307

# -- Enable a prometheus ServiceMonitor

308

enabled: false

309

# -- Prometheus ServiceMonitor labels

310

additionalLabels: {}

311

# -- Prometheus ServiceMonitor namespace

312

namespace: "" # "monitoring"

313

serviceAccount:

314

# -- Create a service account for the controller

315

create: true

316

# -- Service account name

317

318

# -- Labels applied to created service account

319

labels: {}

320

# -- Annotations applied to created service account

321

annotations: {}

322

# -- Workflow controller name string

323

324

# -- Specify all namespaces where this workflow controller instance will manage

325

# workflows. This controls where the service account and RBAC resources will

326

# be created. Only valid when singleNamespace is false.

327

workflowNamespaces:

328

- default

329

instanceID:

330

# -- Configures the controller to filter workflow submissions

331

# to only those which have a matching instanceID attribute.

332

## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`

333

## or `instanceID.explicitID` must be defined.

334

enabled: false

335

# -- Use ReleaseName as instanceID

336

useReleaseName: false

337

# useReleaseName: true

338

339

# -- Use a custom instanceID

340

explicitID: ""

341

# explicitID: unique-argo-controller-identifier

342

logging:

343

# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)

344

level: info

345

# -- Set the glog logging level

346

globallevel: "0"

347

# -- Set the logging format (one of: `text`, `json`)

348

format: "text"

349

# -- Service type of the controller Service

350

serviceType: ClusterIP

351

# -- Annotations to be applied to the controller Service

352

serviceAnnotations: {}

353

# -- Optional labels to add to the controller Service

354

serviceLabels: {}

355

# -- The class of the load balancer implementation

356

loadBalancerClass: ""

357

# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`

358

loadBalancerSourceRanges: []

359

# -- Resource limits and requests for the controller

360

resources: {}

361

# -- Configure liveness [probe] for the controller

362

# @default -- See [values.yaml]

363

livenessProbe:

364

httpGet:

365

port: 6060

366

path: /healthz

367

failureThreshold: 3

368

initialDelaySeconds: 90

369

periodSeconds: 60

370

timeoutSeconds: 30

371

# -- Extra environment variables to provide to the controller container

372

extraEnv: []

373

# - name: FOO

374

# value: "bar"

375

376

# -- envFrom to pass to the controller container

377

envFrom: []

378

# -- Extra arguments to be added to the controller

379

extraArgs: []

380

# -- Additional volume mounts to the controller main container

381

volumeMounts: []

382

# -- Additional volumes to the controller pod

383

volumes: []

384

# -- The number of controller pods to run

385

replicas: 1

386

# -- The number of revisions to keep.

387

revisionHistoryLimit: 10

388

pdb:

389

# -- Configure [Pod Disruption Budget] for the controller pods

390

enabled: false

391

# minAvailable: 1

392

# maxUnavailable: 1

393

# -- [Node selector]

394

nodeSelector:

395

kubernetes.io/os: linux

396

# -- [Tolerations] for use with node taints

397

tolerations: []

398

# -- Assign custom [affinity] rules

399

affinity: {}

400

# -- Assign custom [TopologySpreadConstraints] rules to the workflow controller

401

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

402

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

403

topologySpreadConstraints: []

404

# - maxSkew: 1

405

# topologyKey: topology.kubernetes.io/zone

406

# whenUnsatisfiable: DoNotSchedule

407

408

# -- Leverage a PriorityClass to ensure your pods survive resource shortages.

409

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

410

priorityClassName: ""

411

# -- Configure Argo Server to show custom [links]

412

## Ref: https://argo-workflows.readthedocs.io/en/stable/links/

413

links: []

414

# -- Configure Argo Server to show custom [columns]

415

## Ref: https://github.com/argoproj/argo-workflows/pull/10693

416

columns: []

417

# -- Set ui navigation bar background color

418

navColor: ""

419

clusterWorkflowTemplates:

420

# -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.

421

enabled: true

422

# -- Extra service accounts to be added to the ClusterRoleBinding

423

serviceAccounts: []

424

# - name: my-service-account

425

# namespace: my-namespace

426

# -- Extra containers to be added to the controller deployment

427

extraContainers: []

428

# -- Enables init containers to be added to the controller deployment

429

extraInitContainers: []

430

# -- Workflow retention by number of workflows

431

retentionPolicy: {}

432

# completed: 10

433

# failed: 3

434

# errored: 3

435

436

nodeEvents:

437

# -- Enable to emit events on node completion.

438

## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events:

439

## "Unable to create audit event: etcdserver: mvcc: database space exceeded"

440

enabled: true

441

workflowEvents:

442

# -- Enable to emit events on workflow status changes.

443

## This can take up a lot of space in k8s (typically etcd), resulting in errors when trying to create new events:

444

## "Unable to create audit event: etcdserver: mvcc: database space exceeded"

445

enabled: true

446

# -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads,

447

# or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret.

448

# @default -- `{}` (See [values.yaml])

449

kubeConfig: {}

450

# # name of the kubeconfig secret, may not be empty when kubeConfig specified

451

# secretName: kubeconfig-secret

452

# # key of the kubeconfig secret, may not be empty when kubeConfig specified

453

# secretKey: kubeconfig

454

# # mounting path of the kubeconfig secret, default to /kube/config

455

# mountPath: /kubeconfig/mount/path

456

# # volume name when mounting the secret, default to kubeconfig

457

# volumeName: kube-config-volume

458

459

# -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately.

460

# @default -- `30` seconds (Kubernetes default)

461

podGCGracePeriodSeconds:

462

# -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately.

463

# @default -- `5s` (Argo Workflows default)

464

podGCDeleteDelayDuration: ""

465

# -- enable Synchronization to use a database. Postgres and MySQL (>= 5.7.8) are available.

466

## Ref: https://argo-workflows.readthedocs.io/en/latest/workflow-controller-configmap/#syncconfig

467

synchronization: {}

468

# controllerName: argo-workflows

469

# connectionPool:

470

# maxIdleConns: 100

471

# maxOpenConns: 0

472

# postgresql:

473

# host: localhost

474

# port: 5432

475

# database: postgres

476

# tableName: argo_workflows

477

# # the database secrets must be in the same namespace of the controller

478

# userNameSecret:

479

# name: argo-postgres-config

480

# key: username

481

# passwordSecret:

482

# name: argo-postgres-config

483

# key: password

484

# ssl: true

485

# # sslMode must be one of: disable, require, verify-ca, verify-full

486

# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq

487

# sslMode: require

488

# mysql:

489

# host: localhost

490

# port: 3306

491

# database: argo

492

# tableName: argo_workflows

493

# userNameSecret:

494

# name: argo-mysql-config

495

# key: username

496

# passwordSecret:

497

# name: argo-mysql-config

498

# key: password

499

500

failedPodRestart:

501

# -- Enable to restart of pods that fail before entering Running state.

502

## This is useful for recovering from transient infrastructure issues like node eviction due to DiskPressure or MemoryPressure without requiring a retryStrategy on every template.

503

## ref: https://argo-workflows.readthedocs.io/en/latest/pod-restarts/

504

enabled: false

505

# -- Maximum number of automatic restarts per node before giving up.

506

maxRestarts: 3

507

# -- Disable the creation of agent pods, which are used for HTTP and Plugin templates. When enabled, HTTP and Plugin templates will not be processed by this controller.

508

# Only valid for 4.1+

509

disableAgentPodCreation: false

510

initlessPod:

511

# -- Enable the init-less pod layout (beta), which provides the executor to workflow pods through an image volume instead of an init container.

512

# Only valid for 4.1+. Requires the `ImageVolume` feature gate on the kube-apiserver and all kubelets (beta in Kubernetes v1.33-1.35, enabled by default from v1.36).

513

## Ref: https://argo-workflows.readthedocs.io/en/latest/initless-pod/

514

enabled: false

515

# mainContainer adds default config for main container that could be overriden in workflows template

516

mainContainer:

517

# -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`.

518

imagePullPolicy: ""

519

# -- Resource limits and requests for the Workflow main container

520

resources: {}

521

# -- Adds environment variables for the Workflow main container

522

env: []

523

# -- Adds reference environment variables for the Workflow main container

524

envFrom: []

525

# -- sets security context for the Workflow main container

526

securityContext: {}

527

# executor controls how the init and wait container should be customized

528

executor:

529

image:

530

# -- Registry to use for the Workflow Executors

531

registry: cgr.dev

532

# -- Repository to use for the Workflow Executors

533

repository: chainguard-private/argo-exec

534

# -- Image tag for the workflow executor. Defaults to `.Values.images.tag`.

535

tag: 4.1.2@sha256:557803ecb94619eea8014597aedd030c5ca6fa7864205ee37b824107301afc62

536

# -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`.

537

pullPolicy: ""

538

# -- Use the `-nonroot` executor image variant. When enabled, the `-nonroot` suffix is appended to the resolved image tag.

539

nonroot: false

540

# -- Resource limits and requests for the Workflow Executors

541

resources: {}

542

# -- Passes arguments to the executor processes

543

args: []

544

# -- Adds environment variables for the executor.

545

env: []

546

# -- sets security context for the executor container

547

securityContext: {}

548

server:

549

# -- Deploy the Argo Server

550

enabled: true

551

# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.

552

## only updates base url of resources on client side,

553

## it's expected that a proxy server rewrites the request URL and gets rid of this prefix

554

## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190

555

baseHref: /

556

image:

557

# -- Registry to use for the server

558

registry: cgr.dev

559

# -- Repository to use for the server

560

repository: chainguard-private/argo-cli

561

# -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.

562

tag: 4.1.2@sha256:a5e004f03e2ca938d5cfacc9f385dc4adf536e4f65277e5228ac1b8b0a2e8a97

563

# -- optional map of annotations to be applied to the ui Deployment

564

deploymentAnnotations: {}

565

# -- optional map of annotations to be applied to the ui Pods

566

podAnnotations: {}

567

# -- Optional labels to add to the UI pods

568

podLabels: {}

569

# -- SecurityContext to set on the server pods

570

podSecurityContext: {}

571

rbac:

572

# -- Adds Role and RoleBinding for the server.

573

create: true

574

# -- Servers container-level security context

575

securityContext:

576

readOnlyRootFilesystem: false

577

runAsNonRoot: true

578

allowPrivilegeEscalation: false

579

capabilities:

580

drop:

581

- ALL

582

# -- Server name string

583

584

# -- Service type for server pods

585

serviceType: ClusterIP

586

# -- Service port for server

587

servicePort: 2746

588

# -- Service target port for server

589

serviceTargetPort: 2746

590

# -- Service node port

591

serviceNodePort: # 32746

592

# -- Service port name

593

servicePortName: "" # http

594

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

595

hostAliases: []

596

# - ip: 10.20.30.40

597

# hostnames:

598

# - git.myhostname

599

600

serviceAccount:

601

# -- Create a service account for the server

602

create: true

603

# -- Service account name

604

605

# -- Labels applied to created service account

606

labels: {}

607

# -- Annotations applied to created service account

608

annotations: {}

609

# -- Annotations to be applied to the UI Service

610

serviceAnnotations: {}

611

# -- Optional labels to add to the UI Service

612

serviceLabels: {}

613

# -- The class of the load balancer implementation

614

loadBalancerClass: ""

615

# -- Static IP address to assign to loadBalancer service type `LoadBalancer`

616

loadBalancerIP: ""

617

# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`

618

loadBalancerSourceRanges: []

619

# -- Resource limits and requests for the server

620

resources: {}

621

# -- The number of server pods to run

622

replicas: 1

623

# -- The number of revisions to keep.

624

revisionHistoryLimit: 10

625

## Argo Server Horizontal Pod Autoscaler

626

autoscaling:

627

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server

628

enabled: false

629

# -- Minimum number of replicas for the Argo Server [HPA]

630

minReplicas: 1

631

# -- Maximum number of replicas for the Argo Server [HPA]

632

maxReplicas: 5

633

# -- Average CPU utilization percentage for the Argo Server [HPA]

634

targetCPUUtilizationPercentage: 50

635

# -- Average memory utilization percentage for the Argo Server [HPA]

636

targetMemoryUtilizationPercentage: 50

637

# -- Configures the scaling behavior of the target in both Up and Down directions.

638

# This is only available on HPA apiVersion `autoscaling/v2beta2` and newer

639

behavior: {}

640

# scaleDown:

641

# stabilizationWindowSeconds: 300

642

# policies:

643

# - type: Pods

644

# value: 1

645

# periodSeconds: 180

646

# scaleUp:

647

# stabilizationWindowSeconds: 300

648

# policies:

649

# - type: Pods

650

# value: 2

651

pdb:

652

# -- Configure [Pod Disruption Budget] for the server pods

653

enabled: false

654

# minAvailable: 1

655

# maxUnavailable: 1

656

# -- [Node selector]

657

nodeSelector:

658

kubernetes.io/os: linux

659

# -- [Tolerations] for use with node taints

660

tolerations: []

661

# -- Assign custom [affinity] rules

662

affinity: {}

663

# -- Assign custom [TopologySpreadConstraints] rules to the argo server

664

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

665

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

666

topologySpreadConstraints: []

667

# - maxSkew: 1

668

# topologyKey: topology.kubernetes.io/zone

669

# whenUnsatisfiable: DoNotSchedule

670

671

# -- Leverage a PriorityClass to ensure your pods survive resource shortages

672

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

673

priorityClassName: ""

674

# -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs.

675

## See the following documentation for more details on secure mode:

676

## https://argo-workflows.readthedocs.io/en/stable/tls/

677

secure: false

678

# -- Extra environment variables to provide to the argo-server container

679

extraEnv: []

680

# - name: FOO

681

# value: "bar"

682

683

# -- envFrom to pass to the argo-server container

684

envFrom: []

685

# -- Deprecated; use server.authModes instead.

686

authMode: ""

687

# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.

688

## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/

689

authModes: []

690

# -- Extra arguments to provide to the Argo server binary.

691

## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options

692

extraArgs: []

693

logging:

694

# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)

695

level: info

696

# -- Set the glog logging level

697

globallevel: "0"

698

# -- Set the logging format (one of: `text`, `json`)

699

format: "text"

700

# -- Volume to be mounted in Pods for temporary files.

701

tmpVolume:

702

emptyDir: {}

703

# -- Additional volume mounts to the server main container.

704

volumeMounts: []

705

# -- Additional volumes to the server pod.

706

volumes: []

707

## Ingress configuration.

708

# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/

709

ingress:

710

# -- Enable an ingress resource

711

enabled: false

712

# -- Additional ingress annotations

713

annotations: {}

714

# -- Additional ingress labels

715

labels: {}

716

# -- Defines which ingress controller will implement the resource

717

ingressClassName: ""

718

# -- List of ingress hosts

719

## Hostnames must be provided if Ingress is enabled.

720

## Secrets must be manually created in the namespace

721

hosts: []

722

# - argoworkflows.example.com

723

724

# -- List of ingress paths

725

paths:

726

- /

727

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

728

pathType: Prefix

729

# -- Additional ingress paths

730

extraPaths: []

731

# - path: /*

732

# backend:

733

# serviceName: ssl-redirect

734

# servicePort: use-annotation

735

## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)

736

# - path: /*

737

# pathType: Prefix

738

# backend:

739

# service

740

# name: ssl-redirect

741

# port:

742

# name: use-annotation

743

744

# -- Ingress TLS configuration

745

tls: []

746

# - secretName: argoworkflows-example-tls

747

# hosts:

748

# - argoworkflows.example.com

749

## Create a Google Backendconfig for use with the GKE Ingress Controller

750

## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters

751

GKEbackendConfig:

752

# -- Enable BackendConfig custom resource for Google Kubernetes Engine

753

enabled: false

754

# -- [BackendConfigSpec]

755

spec: {}

756

# spec:

757

# iap:

758

# enabled: true

759

# oauthclientCredentials:

760

# secretName: argoworkflows-secret

761

762

## Create a Google Managed Certificate for use with the GKE Ingress Controller

763

## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

764

GKEmanagedCertificate:

765

# -- Enable ManagedCertificate custom resource for Google Kubernetes Engine.

766

enabled: false

767

# -- Domains for the Google Managed Certificate

768

domains:

769

- argoworkflows.example.com

770

## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller

771

## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

772

GKEfrontendConfig:

773

# -- Enable FrontConfig custom resource for Google Kubernetes Engine

774

enabled: false

775

# -- [FrontendConfigSpec]

776

spec: {}

777

# spec:

778

# redirectToHttps:

779

# enabled: true

780

# responseCodeName: RESPONSE_CODE

781

782

# Gateway API HTTPRoute configuration

783

# NOTE: Gateway API support is in EXPERIMENTAL status

784

# Support depends on your Gateway controller implementation

785

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

786

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

787

httproute:

788

# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)

789

enabled: false

790

# -- Additional HTTPRoute labels

791

labels: {}

792

# -- Additional HTTPRoute annotations

793

annotations: {}

794

# -- Gateway API parentRefs for the HTTPRoute

795

## Must reference an existing Gateway

796

# @default -- `[]` (See [values.yaml])

797

parentRefs: []

798

# - name: example-gateway

799

# namespace: example-gateway-namespace

800

# sectionName: https

801

# -- List of hostnames for the HTTPRoute

802

# @default -- `[]` (See [values.yaml])

803

hostnames: []

804

# - argoworkflows.example.com

805

# -- HTTPRoute rules configuration

806

# @default -- `[]` (See [values.yaml])

807

rules:

808

- matches:

809

- path:

810

type: PathPrefix

811

value: /

812

# filters: []

813

# - type: RequestHeaderModifier

814

# requestHeaderModifier:

815

# add:

816

# - name: X-Custom-Header

817

# value: custom-value

818

# timeouts:

819

# request: 10s

820

# backendRequest: 2s

821

# Gateway API BackendTLSPolicy configuration

822

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

823

# Required for HTTPS backends when using Gateway API

824

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

825

backendTLSPolicy:

826

# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)

827

enabled: false

828

# -- Additional BackendTLSPolicy labels

829

labels: {}

830

# -- Additional BackendTLSPolicy annotations

831

annotations: {}

832

# -- Target references for the BackendTLSPolicy

833

# @default -- `[]` (See [values.yaml])

834

targetRefs: []

835

# - group: ""

836

# kind: Service

837

# name: argo-workflows-server

838

# sectionName: https

839

# -- TLS validation configuration

840

# @default -- `{}` (See [values.yaml])

841

validation: {}

842

# hostname: argo-workflows-server.argo.svc.cluster.local

843

# caCertificateRefs:

844

# - name: example-ca-cert

845

# group: ""

846

# kind: ConfigMap

847

# wellKnownCACertificates: System

848

clusterWorkflowTemplates:

849

# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.

850

enabled: true

851

# -- Give the server permissions to edit ClusterWorkflowTemplates.

852

enableEditing: true

853

# SSO configuration when SSO is specified as a server auth mode.

854

sso:

855

# -- Create SSO configuration. If you set `true` , please also set `.Values.server.authModes` as `sso`.

856

enabled: false

857

# -- The root URL of the OIDC identity provider

858

issuer: https://accounts.google.com

859

clientId:

860

# -- Name of secret to retrieve the app OIDC client ID

861

862

# -- Key of secret to retrieve the app OIDC client ID

863

key: client-id

864

clientSecret:

865

# -- Name of a secret to retrieve the app OIDC client secret

866

867

# -- Key of a secret to retrieve the app OIDC client secret

868

key: client-secret

869

# -- The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.

870

redirectUrl: ""

871

rbac:

872

# -- Adds ServiceAccount Policy to server (Cluster)Role.

873

enabled: true

874

# -- Whitelist to allow server to fetch Secrets

875

## When present, restricts secrets the server can read to a given list.

876

## You can use it to restrict the server to only be able to access the

877

## service account token secrets that are associated with service accounts

878

## used for authorization.

879

secretWhitelist: []

880

# -- Scopes requested from the SSO ID provider

881

## The 'groups' scope requests group membership information, which is usually used for authorization decisions.

882

scopes: []

883

# - groups

884

# -- Define how long your login is valid for (in hours)

885

## If omitted, defaults to 10h.

886

sessionExpiry: ""

887

# -- Alternate root URLs that can be included for some OIDC providers

888

issuerAlias: ""

889

# -- Override claim name for OIDC groups

890

customGroupClaimName: ""

891

# -- Specify the user info endpoint that contains the groups claim

892

## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta)

893

userInfoPath: ""

894

# -- Skip TLS verification for the HTTP client

895

insecureSkipVerify: false

896

# -- Custom PEM encoded CA certificate file contents used to validate the OIDC provider's certificate

897

rootCA: ""

898

# -- Filter the groups returned by the OIDC provider

899

## A logical "OR" is used between each regex in the list

900

filterGroupsRegex: []

901

# - ".*argo-wf.*"

902

# - ".*argo-workflow.*"

903

# -- Extra containers to be added to the server deployment

904

extraContainers: []

905

# -- Enables init containers to be added to the server deployment

906

extraInitContainers: []

907

# -- Specify postStart and preStop lifecycle hooks for server container

908

lifecycle: {}

909

# -- terminationGracePeriodSeconds for container lifecycle hook

910

terminationGracePeriodSeconds: 30

911

## livenessProbe for server

912

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

913

livenessProbe:

914

# -- Enable Kubernetes liveness probe for server

915

enabled: false

916

httpGet:

917

# -- Http port to use for the liveness probe

918

port: 2746

919

# -- Http path to use for the liveness probe

920

path: /

921

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

922

failureThreshold: 3

923

# -- Number of seconds after the container has started before [probe] is initiated

924

initialDelaySeconds: 10

925

# -- How often (in seconds) to perform the [probe]

926

periodSeconds: 10

927

# -- Number of seconds after which the [probe] times out

928

timeoutSeconds: 1

929

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

930

successThreshold: 1

931

# -- Array of extra K8s manifests to deploy

932

extraObjects: []

933

# - apiVersion: secrets-store.csi.x-k8s.io/v1

934

# kind: SecretProviderClass

935

# metadata:

936

# name: argo-server-sso

937

# spec:

938

# provider: aws

939

# parameters:

940

# objects: |

941

# - objectName: "argo/server/sso"

942

# objectType: "secretsmanager"

943

# jmesPath:

944

# - path: "client_id"

945

# objectAlias: "client_id"

946

# - path: "client_secret"

947

# objectAlias: "client_secret"

948

# secretObjects:

949

# - data:

950

# - key: client_id

951

# objectName: client_id

952

# - key: client_secret

953

# objectName: client_secret

954

# secretName: argo-server-sso-secrets-store

955

# type: Opaque

956

957

# -- Use static credentials for S3 (eg. when not using AWS IRSA)

958

useStaticCredentials: true

959

artifactRepository:

960

# -- Archive the main container logs as an artifact

961

archiveLogs: false

962

# -- Store artifact in a S3-compliant object store

963

# @default -- See [values.yaml]

964

s3: {}

965

# # Note the `key` attribute is not the actual secret, it's the PATH to

966

# # the contents in the associated secret, as defined by the `name` attribute.

967

# accessKeySecret:

968

# name: "{{ .Release.Name }}-minio"

969

# key: accesskey

970

# secretKeySecret:

971

# name: "{{ .Release.Name }}-minio"

972

# key: secretkey

973

# sessionTokenSecret:

974

# name: "{{ .Release.Name }}-minio"

975

# key: sessionToken

976

# # insecure will disable TLS. Primarily used for minio installs not configured with TLS

977

# insecure: false

978

# caSecret:

979

# name: ca-root

980

# key: cert.pem

981

# bucket:

982

# endpoint:

983

# region:

984

# roleARN:

985

# useSDKCreds: true

986

# # addressingStyle must be one of: "" (auto-detect), path, virtual-hosted

987

# # Only valid for 4.1+

988

# addressingStyle: ""

989

# encryptionOptions:

990

# enableEncryption: true

991

# -- Store artifact in a GCS object store

992

# @default -- `{}` (See [values.yaml])

993

gcs: {}

994

# bucket: <project>-argo

995

# keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}"

996

# # serviceAccountKeySecret is a secret selector.

997

# # It references the k8s secret named 'my-gcs-credentials'.

998

# # This secret is expected to have the key 'serviceAccountKey',

999

# # containing the base64 encoded credentials

1000

# # to the bucket.

1001

# #

1002

# # If it's running on GKE and Workload Identity is used,

1003

# # serviceAccountKeySecret is not needed.

1004

# serviceAccountKeySecret:

1005

# name: my-gcs-credentials

1006

# key: serviceAccountKey

1007

# -- Store artifact in Azure Blob Storage

1008

# @default -- `{}` (See [values.yaml])

1009

azure: {}

1010

# endpoint: https://mystorageaccountname.blob.core.windows.net

1011

# container: my-container-name

1012

# blobNameFormat: path/in/container

1013

# # accountKeySecret is a secret selector.

1014

# # It references the k8s secret named 'my-azure-storage-credentials'.

1015

# # This secret is expected to have the key 'account-access-key',

1016

# # containing the base64 encoded credentials to the storage account.

1017

# # If a managed identity has been assigned to the machines running the

1018

# # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)

1019

# # then accountKeySecret is not needed, and useSDKCreds should be

1020

# # set to true instead:

1021

# useSDKCreds: true

1022

# accountKeySecret:

1023

# name: my-azure-storage-credentials

1024

# key: account-access-key

1025

# -- The section of custom artifact repository.

1026

# Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure)

1027

customArtifactRepository: {}

1028

# artifactory:

1029

# repoUrl: https://artifactory.example.com/raw

1030

# usernameSecret:

1031

# name: artifactory-creds

1032

# key: username

1033

# passwordSecret:

1034

# name: artifactory-creds

1035

# key: password

1036

1037

# -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/).

1038

# Each map key is the name of configmap

1039

# @default -- `{}` (See [values.yaml])

1040

artifactRepositoryRef: {}

1041

# # -- 1st ConfigMap

1042

# # If you want to use this config map by default, name it "artifact-repositories".

1043

# # Otherwise, you can provide a reference to a

1044

# # different config map in `artifactRepositoryRef.configMap`.

1045

# artifact-repositories:

1046

# # -- v3.0 and after - if you want to use a specific key, put that key into this annotation.

1047

# annotations:

1048

# workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository

1049

# # 1st data of configmap. See above artifactRepository or customArtifactRepository.

1050

# default-v1-s3-artifact-repository:

1051

# archiveLogs: false

1052

# s3:

1053

# bucket: my-bucket

1054

# endpoint: minio:9000

1055

# insecure: true

1056

# accessKeySecret:

1057

# name: my-minio-cred

1058

# key: accesskey

1059

# secretKeySecret:

1060

# name: my-minio-cred

1061

# key: secretkey

1062

# # 2nd data

1063

# oss-artifact-repository:

1064

# archiveLogs: false

1065

# oss:

1066

# endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com

1067

# bucket: $mybucket

1068

# # accessKeySecret and secretKeySecret are secret selectors.

1069

# # It references the k8s secret named 'bucket-workflow-artifect-credentials'.

1070

# # This secret is expected to have the keys 'accessKey'

1071

# # and 'secretKey', containing the base64 encoded credentials

1072

# # to the bucket.

1073

# accessKeySecret:

1074

# name: $mybucket-credentials

1075

# key: accessKey

1076

# secretKeySecret:

1077

# name: $mybucket-credentials

1078

# key: secretKey

1079

# # 2nd ConfigMap

1080

# another-artifact-repositories:

1081

# annotations:

1082

# workflows.argoproj.io/default-artifact-repository: gcs

1083

# gcs:

1084

# bucket: my-bucket

1085

# keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}}

1086

# serviceAccountKeySecret:

1087

# name: my-gcs-credentials

1088

# key: serviceAccountKey

1089

1090

emissary:

1091

# -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used.

1092

## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary

1093

images: []

1094

# argoproj/argosay:v2:

1095

# cmd: [/argosay]

1096

# docker/whalesay:latest:

1097

# cmd: [/bin/bash]

1098

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-workflows

The trusted source for open source

Product

Solutions

Customers

Resources

Company