argo-workflows
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
images:
2
# -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`.
3
tag: ""
4
# -- imagePullPolicy to apply to all containers
5
pullPolicy: Always
6
# -- Secrets with credentials to pull images from a private registry
7
pullSecrets: []
8
# - name: argo-pull-secret
9
## Custom resource configuration
10
crds:
11
# -- Install and upgrade CRDs
12
install: true
13
# -- Keep CRDs on chart uninstall
14
keep: true
15
# -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
16
# Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
17
full: true
18
# -- Annotations to be added to all CRDs (only applies when crds.full=false)
19
annotations: {}
20
# Configuration for the CRD install Job (only used when crds.full=true)
21
upgradeJob:
22
# -- Image for the kubectl container that applies CRDs
23
image:
24
# -- Repository for the kubectl image
25
repository: cgr.dev/chainguard-private/kubectl
26
# -- Tag for the kubectl image
27
tag: latest@sha256:a56de917c0c555cd0bf7fccdd953ef26b87276392963b9562a483ed67e373901
28
# -- Override base URL to download full CRD YAML files from. Defaults to this chart's release tag on GitHub. Ignored if hostPath is set.
29
crdBaseURL: ""
30
# -- Host path to mount CRD files from (for local/CI testing). When set, CRDs are applied from this path instead of downloading.
31
hostPath: ""
32
# -- Resources for the CRD install Job containers
33
resources: {}
34
# -- Node selector for the CRD install Job
35
nodeSelector: {}
36
# -- Pod security context for the CRD install Job pod
37
podSecurityContext: {}
38
# -- Optional labels to add to the CRD install Job pod
39
podLabels: {}
40
# -- Tolerations for the CRD install Job
41
tolerations: []
42
# -- Image pull secrets for the CRD install Job
43
imagePullSecrets: []
44
# -- Security context for the CRD install Job container
45
securityContext:
46
readOnlyRootFilesystem: true
47
runAsNonRoot: true
48
allowPrivilegeEscalation: false
49
runAsUser: 65532
50
runAsGroup: 65532
51
seccompProfile:
52
type: RuntimeDefault
53
capabilities:
54
drop:
55
- ALL
56
# -- Extra environment variables to provide to the CRD install Job container
57
extraEnv: []
58
# - name: HTTP_PROXY
59
# value: "http://proxy.example.com:8080"
60
# - name: HTTPS_PROXY
61
# value: "http://proxy.example.com:8080"
62
# - name: NO_PROXY
63
# value: "localhost,127.0.0.1,10.96.0.0/12,192.168.0.0/16"
64
# -- Create ClusterRoles that extend existing ClusterRoles to interact with Argo Workflows CRDs.
65
## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
66
createAggregateRoles: true
67
# -- String to partially override "argo-workflows.fullname" template
68
nameOverride:
69
# -- String to fully override "argo-workflows.fullname" template
70
fullnameOverride:
71
# -- Override the namespace
72
# @default -- `.Release.Namespace`
73
namespaceOverride: ""
74
# -- Labels to set on all resources
75
commonLabels: {}
76
# -- Override the Kubernetes version, which is used to evaluate certain manifests
77
kubeVersionOverride: ""
78
# Override APIVersions
79
apiVersionOverrides:
80
# -- String to override apiVersion of autoscaling rendered by this helm chart
81
autoscaling: "" # autoscaling/v2
82
# -- String to override apiVersion of GKE resources rendered by this helm chart
83
cloudgoogle: "" # cloud.google.com/v1
84
# -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart
85
monitoring: "" # monitoring.coreos.com/v1
86
# -- Restrict Argo to operate only in a single namespace (the namespace of the
87
# Helm release) by apply Roles and RoleBindings instead of the Cluster
88
# equivalents, and start workflow-controller with the --namespaced flag. Use it
89
# in clusters with strict access policy.
90
singleNamespace: false
91
workflow:
92
# -- Deprecated; use controller.workflowNamespaces instead.
93
namespace:
94
serviceAccount:
95
# -- Specifies whether a service account should be created
96
create: false
97
# -- Specifies whether a secret for each service account should be created
98
createSecret: false
99
# -- Labels applied to created service account
100
labels: {}
101
# -- Annotations applied to created service account
102
annotations: {}
103
# -- Service account which is used to run workflows
104
name: "argo-workflow"
105
# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`
106
pullSecrets: []
107
rbac:
108
# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.
109
# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)
110
create: true
111
# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates
112
agentPermissions: false
113
# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc
114
artifactGC: false
115
# -- Extra service accounts to be added to the RoleBinding
116
serviceAccounts: []
117
# - name: my-service-account
118
# namespace: my-namespace
119
# -- Additional rules for the service account that runs the workflows.
120
rules: []
121
controller:
122
image:
123
# -- Registry to use for the controller
124
registry: cgr.dev
125
# -- Registry to use for the controller
126
repository: chainguard-private/argo-workflowcontroller
127
# -- Image tag for the workflow controller. Defaults to `.Values.images.tag`.
128
tag: latest@sha256:4a1fb003cfd64225fda6c516a56fe5f406fafb8ef23eec16e1f93d933144b91e
129
# -- parallelism dictates how many workflows can be running at the same time
130
parallelism:
131
# -- Globally limits the rate at which pods are created.
132
# This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of
133
# parallel nodes.
134
resourceRateLimit: {}
135
# limit: 10
136
# burst: 1
137
138
rbac:
139
# -- Adds Role and RoleBinding for the controller.
140
create: true
141
# -- Allows controller to get, list, and watch certain k8s secrets
142
secretWhitelist: []
143
# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.
144
accessAllSecrets: false
145
# -- Allows controller to create and update ConfigMaps. Enables memoization feature
146
writeConfigMaps: false
147
configMap:
148
# -- Create a ConfigMap for the controller
149
create: true
150
# -- ConfigMap name
151
name: ""
152
# -- ConfigMap annotations
153
annotations: {}
154
# -- Limits the maximum number of incomplete workflows in a namespace
155
namespaceParallelism:
156
# -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224
157
initialDelay:
158
# -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment
159
deploymentAnnotations: {}
160
# -- podAnnotations is an optional map of annotations to be applied to the controller Pods
161
podAnnotations: {}
162
# -- Optional labels to add to the controller pods
163
podLabels: {}
164
# -- SecurityContext to set on the controller pods
165
podSecurityContext: {}
166
# podPortName: http
167
metricsConfig:
168
# -- Enables prometheus metrics server
169
enabled: false
170
# -- Path is the path where metrics are emitted. Must start with a "/".
171
path: /metrics
172
# -- Frequency at which prometheus scrapes metrics
173
interval: 30s
174
# -- Port is the port where metrics are emitted
175
port: 9090
176
# -- How often custom metrics are cleared from memory
177
metricsTTL: ""
178
# -- Flag that instructs prometheus to ignore metric emission errors.
179
ignoreErrors: false
180
# -- Flag that use a self-signed cert for TLS
181
secure: false
182
# -- Container metrics port name
183
portName: metrics
184
# -- Service metrics port
185
servicePort: 8080
186
# -- Service metrics port name
187
servicePortName: metrics
188
# -- serviceMonitor scheme
189
scheme: http
190
# -- Flag to enable headless service
191
headlessService: false
192
# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.
193
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#honorlabels
194
honorLabels: false
195
# -- ServiceMonitor relabel configs to apply to samples before scraping
196
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
197
relabelings: []
198
# -- ServiceMonitor metric relabel configs to apply to samples before ingestion
199
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint
200
metricRelabelings: []
201
# -- ServiceMonitor will add labels from the service to the Prometheus metric
202
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec
203
targetLabels: []
204
# -- Manipulate the metrics created by the workflow controller
205
## Ref: https://argo-workflows.readthedocs.io/en/latest/metrics/#modifiers
206
modifiers: {}
207
# -- the controller container's securityContext
208
securityContext:
209
readOnlyRootFilesystem: true
210
runAsNonRoot: true
211
allowPrivilegeEscalation: false
212
capabilities:
213
drop:
214
- ALL
215
# -- enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available.
216
## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/
217
persistence: {}
218
# connectionPool:
219
# maxIdleConns: 100
220
# maxOpenConns: 0
221
# # save the entire workflow into etcd and DB
222
# nodeStatusOffLoad: false
223
# # enable archiving of old workflows
224
# archive: false
225
# postgresql:
226
# host: localhost
227
# port: 5432
228
# database: postgres
229
# tableName: argo_workflows
230
# # the database secrets must be in the same namespace of the controller
231
# userNameSecret:
232
# name: argo-postgres-config
233
# key: username
234
# passwordSecret:
235
# name: argo-postgres-config
236
# key: password
237
# ssl: true
238
# # sslMode must be one of: disable, require, verify-ca, verify-full
239
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
240
# sslMode: require
241
# mysql:
242
# host: localhost
243
# port: 3306
244
# database: argo
245
# tableName: argo_workflows
246
# userNameSecret:
247
# name: argo-mysql-config
248
# key: username
249
# passwordSecret:
250
# name: argo-mysql-config
251
# key: password
252
253
# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.
254
# Only valid for 2.7+
255
## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/
256
workflowDefaults: {}
257
# spec:
258
# ttlStrategy:
259
# secondsAfterCompletion: 86400
260
# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/
261
# artifactRepositoryRef:
262
# configMap: my-artifact-repository # default is "artifact-repositories"
263
# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.
264
265
# -- Number of workflow workers
266
workflowWorkers: # 32
267
# -- Number of workflow TTL workers
268
workflowTTLWorkers: # 4
269
# -- Number of pod cleanup workers
270
podCleanupWorkers: # 4
271
# -- Number of cron workflow workers
272
# Only valid for 3.5+
273
cronWorkflowWorkers: # 8
274
# -- Restricts the Workflows that the controller will process.
275
# Only valid for 2.9+
276
workflowRestrictions: {}
277
# templateReferencing: Strict|Secure
278
279
# telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint
280
# as metrics by default, but can be overridden using this config.
281
telemetryConfig:
282
# -- Enables prometheus telemetry server
283
enabled: false
284
# -- telemetry path
285
path: /telemetry
286
# -- Frequency at which prometheus scrapes telemetry data
287
interval: 30s
288
# -- telemetry container port
289
port: 8081
290
# -- How often custom metrics are cleared from memory
291
metricsTTL: ""
292
# -- Flag that instructs prometheus to ignore metric emission errors.
293
ignoreErrors: false
294
# -- Flag that use a self-signed cert for TLS
295
secure: false
296
# -- telemetry service port
297
servicePort: 8081
298
# -- telemetry service port name
299
servicePortName: telemetry
300
# -- telemetry serviceMonitor scheme to use
301
scheme: http
302
serviceMonitor:
303
# -- Enable a prometheus ServiceMonitor
304
enabled: false
305
# -- Prometheus ServiceMonitor labels
306
additionalLabels: {}
307
# -- Prometheus ServiceMonitor namespace
308
namespace: "" # "monitoring"
309
serviceAccount:
310
# -- Create a service account for the controller
311
create: true
312
# -- Service account name
313
name: ""
314
# -- Labels applied to created service account
315
labels: {}
316
# -- Annotations applied to created service account
317
annotations: {}
318
# -- Workflow controller name string
319
name: workflow-controller
320
# -- Specify all namespaces where this workflow controller instance will manage
321
# workflows. This controls where the service account and RBAC resources will
322
# be created. Only valid when singleNamespace is false.
323
workflowNamespaces:
324
- default
325
instanceID:
326
# -- Configures the controller to filter workflow submissions
327
# to only those which have a matching instanceID attribute.
328
## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`
329
## or `instanceID.explicitID` must be defined.
330
enabled: false
331
# -- Use ReleaseName as instanceID
332
useReleaseName: false
333
# useReleaseName: true
334
335
# -- Use a custom instanceID
336
explicitID: ""
337
# explicitID: unique-argo-controller-identifier
338
logging:
339
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
340
level: info
341
# -- Set the glog logging level
342
globallevel: "0"
343
# -- Set the logging format (one of: `text`, `json`)
344
format: "text"
345
# -- Service type of the controller Service
346
serviceType: ClusterIP
347
# -- Annotations to be applied to the controller Service
348
serviceAnnotations: {}
349
# -- Optional labels to add to the controller Service
350
serviceLabels: {}
351
# -- The class of the load balancer implementation
352
loadBalancerClass: ""
353
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
354
loadBalancerSourceRanges: []
355
# -- Resource limits and requests for the controller
356
resources: {}
357
# -- Configure liveness [probe] for the controller
358
# @default -- See [values.yaml]
359
livenessProbe:
360
httpGet:
361
port: 6060
362
path: /healthz
363
failureThreshold: 3
364
initialDelaySeconds: 90
365
periodSeconds: 60
366
timeoutSeconds: 30
367
# -- Extra environment variables to provide to the controller container
368
extraEnv: []
369
# - name: FOO
370
# value: "bar"
371
372
# -- envFrom to pass to the controller container
373
envFrom: []
374
# -- Extra arguments to be added to the controller
375
extraArgs: []
376
# -- Additional volume mounts to the controller main container
377
volumeMounts: []
378
# -- Additional volumes to the controller pod
379
volumes: []
380
# -- The number of controller pods to run
381
replicas: 1
382
# -- The number of revisions to keep.
383
revisionHistoryLimit: 10
384
pdb:
385
# -- Configure [Pod Disruption Budget] for the controller pods
386
enabled: false
387
# minAvailable: 1
388
# maxUnavailable: 1
389
# -- [Node selector]
390
nodeSelector:
391
kubernetes.io/os: linux
392
# -- [Tolerations] for use with node taints
393
tolerations: []
394
# -- Assign custom [affinity] rules
395
affinity: {}
396
# -- Assign custom [TopologySpreadConstraints] rules to the workflow controller
397
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
398
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
399
topologySpreadConstraints: []
400
# - maxSkew: 1
401
# topologyKey: topology.kubernetes.io/zone
402
# whenUnsatisfiable: DoNotSchedule
403
404
# -- Leverage a PriorityClass to ensure your pods survive resource shortages.
405
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
406
priorityClassName: ""
407
# -- Configure Argo Server to show custom [links]
408
## Ref: https://argo-workflows.readthedocs.io/en/stable/links/
409
links: []
410
# -- Configure Argo Server to show custom [columns]
411
## Ref: https://github.com/argoproj/argo-workflows/pull/10693
412
columns: []
413
# -- Set ui navigation bar background color
414
navColor: ""
415
clusterWorkflowTemplates:
416
# -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.
417
enabled: true
418
# -- Extra service accounts to be added to the ClusterRoleBinding
419
serviceAccounts: []
420
# - name: my-service-account
421
# namespace: my-namespace
422
# -- Extra containers to be added to the controller deployment
423
extraContainers: []
424
# -- Enables init containers to be added to the controller deployment
425
extraInitContainers: []
426
# -- Workflow retention by number of workflows
427
retentionPolicy: {}
428
# completed: 10
429
# failed: 3
430
# errored: 3
431
432
nodeEvents:
433
# -- Enable to emit events on node completion.
434
## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events:
435
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
436
enabled: true
437
workflowEvents:
438
# -- Enable to emit events on workflow status changes.
439
## This can take up a lot of space in k8s (typically etcd), resulting in errors when trying to create new events:
440
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
441
enabled: true
442
# -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads,
443
# or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret.
444
# @default -- `{}` (See [values.yaml])
445
kubeConfig: {}
446
# # name of the kubeconfig secret, may not be empty when kubeConfig specified
447
# secretName: kubeconfig-secret
448
# # key of the kubeconfig secret, may not be empty when kubeConfig specified
449
# secretKey: kubeconfig
450
# # mounting path of the kubeconfig secret, default to /kube/config
451
# mountPath: /kubeconfig/mount/path
452
# # volume name when mounting the secret, default to kubeconfig
453
# volumeName: kube-config-volume
454
455
# -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately.
456
# @default -- `30` seconds (Kubernetes default)
457
podGCGracePeriodSeconds:
458
# -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately.
459
# @default -- `5s` (Argo Workflows default)
460
podGCDeleteDelayDuration: ""
461
# -- enable Synchronization to use a database. Postgres and MySQL (>= 5.7.8) are available.
462
## Ref: https://argo-workflows.readthedocs.io/en/latest/workflow-controller-configmap/#syncconfig
463
synchronization: {}
464
# controllerName: argo-workflows
465
# connectionPool:
466
# maxIdleConns: 100
467
# maxOpenConns: 0
468
# postgresql:
469
# host: localhost
470
# port: 5432
471
# database: postgres
472
# tableName: argo_workflows
473
# # the database secrets must be in the same namespace of the controller
474
# userNameSecret:
475
# name: argo-postgres-config
476
# key: username
477
# passwordSecret:
478
# name: argo-postgres-config
479
# key: password
480
# ssl: true
481
# # sslMode must be one of: disable, require, verify-ca, verify-full
482
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
483
# sslMode: require
484
# mysql:
485
# host: localhost
486
# port: 3306
487
# database: argo
488
# tableName: argo_workflows
489
# userNameSecret:
490
# name: argo-mysql-config
491
# key: username
492
# passwordSecret:
493
# name: argo-mysql-config
494
# key: password
495
496
failedPodRestart:
497
# -- Enable to restart of pods that fail before entering Running state.
498
## This is useful for recovering from transient infrastructure issues like node eviction due to DiskPressure or MemoryPressure without requiring a retryStrategy on every template.
499
## ref: https://argo-workflows.readthedocs.io/en/latest/pod-restarts/
500
enabled: false
501
# -- Maximum number of automatic restarts per node before giving up.
502
maxRestarts: 3
503
# mainContainer adds default config for main container that could be overriden in workflows template
504
mainContainer:
505
# -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`.
506
imagePullPolicy: ""
507
# -- Resource limits and requests for the Workflow main container
508
resources: {}
509
# -- Adds environment variables for the Workflow main container
510
env: []
511
# -- Adds reference environment variables for the Workflow main container
512
envFrom: []
513
# -- sets security context for the Workflow main container
514
securityContext: {}
515
# executor controls how the init and wait container should be customized
516
executor:
517
image:
518
# -- Registry to use for the Workflow Executors
519
registry: cgr.dev
520
# -- Repository to use for the Workflow Executors
521
repository: chainguard-private/argo-exec
522
# -- Image tag for the workflow executor. Defaults to `.Values.images.tag`.
523
tag: latest@sha256:b03427cdd8ee689142afd17b6cebd3788f3d9b053df9c374092b3ac316c785f8
524
# -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`.
525
pullPolicy: ""
526
# -- Resource limits and requests for the Workflow Executors
527
resources: {}
528
# -- Passes arguments to the executor processes
529
args: []
530
# -- Adds environment variables for the executor.
531
env: []
532
# -- sets security context for the executor container
533
securityContext: {}
534
server:
535
# -- Deploy the Argo Server
536
enabled: true
537
# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.
538
## only updates base url of resources on client side,
539
## it's expected that a proxy server rewrites the request URL and gets rid of this prefix
540
## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190
541
baseHref: /
542
image:
543
# -- Registry to use for the server
544
registry: cgr.dev
545
# -- Repository to use for the server
546
repository: chainguard-private/argo-cli
547
# -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.
548
tag: latest@sha256:08a0ac75c0c4e0bc7d12d747c598a56fc2312221a39a92a9ad2a1b90864f589f
549
# -- optional map of annotations to be applied to the ui Deployment
550
deploymentAnnotations: {}
551
# -- optional map of annotations to be applied to the ui Pods
552
podAnnotations: {}
553
# -- Optional labels to add to the UI pods
554
podLabels: {}
555
# -- SecurityContext to set on the server pods
556
podSecurityContext: {}
557
rbac:
558
# -- Adds Role and RoleBinding for the server.
559
create: true
560
# -- Servers container-level security context
561
securityContext:
562
readOnlyRootFilesystem: false
563
runAsNonRoot: true
564
allowPrivilegeEscalation: false
565
capabilities:
566
drop:
567
- ALL
568
# -- Server name string
569
name: server
570
# -- Service type for server pods
571
serviceType: ClusterIP
572
# -- Service port for server
573
servicePort: 2746
574
# -- Service target port for server
575
serviceTargetPort: 2746
576
# -- Service node port
577
serviceNodePort: # 32746
578
# -- Service port name
579
servicePortName: "" # http
580
# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files
581
hostAliases: []
582
# - ip: 10.20.30.40
583
# hostnames:
584
# - git.myhostname
585
586
serviceAccount:
587
# -- Create a service account for the server
588
create: true
589
# -- Service account name
590
name: ""
591
# -- Labels applied to created service account
592
labels: {}
593
# -- Annotations applied to created service account
594
annotations: {}
595
# -- Annotations to be applied to the UI Service
596
serviceAnnotations: {}
597
# -- Optional labels to add to the UI Service
598
serviceLabels: {}
599
# -- The class of the load balancer implementation
600
loadBalancerClass: ""
601
# -- Static IP address to assign to loadBalancer service type `LoadBalancer`
602
loadBalancerIP: ""
603
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
604
loadBalancerSourceRanges: []
605
# -- Resource limits and requests for the server
606
resources: {}
607
# -- The number of server pods to run
608
replicas: 1
609
# -- The number of revisions to keep.
610
revisionHistoryLimit: 10
611
## Argo Server Horizontal Pod Autoscaler
612
autoscaling:
613
# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server
614
enabled: false
615
# -- Minimum number of replicas for the Argo Server [HPA]
616
minReplicas: 1
617
# -- Maximum number of replicas for the Argo Server [HPA]
618
maxReplicas: 5
619
# -- Average CPU utilization percentage for the Argo Server [HPA]
620
targetCPUUtilizationPercentage: 50
621
# -- Average memory utilization percentage for the Argo Server [HPA]
622
targetMemoryUtilizationPercentage: 50
623
# -- Configures the scaling behavior of the target in both Up and Down directions.
624
# This is only available on HPA apiVersion `autoscaling/v2beta2` and newer
625
behavior: {}
626
# scaleDown:
627
# stabilizationWindowSeconds: 300
628
# policies:
629
# - type: Pods
630
# value: 1
631
# periodSeconds: 180
632
# scaleUp:
633
# stabilizationWindowSeconds: 300
634
# policies:
635
# - type: Pods
636
# value: 2
637
pdb:
638
# -- Configure [Pod Disruption Budget] for the server pods
639
enabled: false
640
# minAvailable: 1
641
# maxUnavailable: 1
642
# -- [Node selector]
643
nodeSelector:
644
kubernetes.io/os: linux
645
# -- [Tolerations] for use with node taints
646
tolerations: []
647
# -- Assign custom [affinity] rules
648
affinity: {}
649
# -- Assign custom [TopologySpreadConstraints] rules to the argo server
650
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
651
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
652
topologySpreadConstraints: []
653
# - maxSkew: 1
654
# topologyKey: topology.kubernetes.io/zone
655
# whenUnsatisfiable: DoNotSchedule
656
657
# -- Leverage a PriorityClass to ensure your pods survive resource shortages
658
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
659
priorityClassName: ""
660
# -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs.
661
## See the following documentation for more details on secure mode:
662
## https://argo-workflows.readthedocs.io/en/stable/tls/
663
secure: false
664
# -- Extra environment variables to provide to the argo-server container
665
extraEnv: []
666
# - name: FOO
667
# value: "bar"
668
669
# -- envFrom to pass to the argo-server container
670
envFrom: []
671
# -- Deprecated; use server.authModes instead.
672
authMode: ""
673
# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.
674
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/
675
authModes: []
676
# -- Extra arguments to provide to the Argo server binary.
677
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options
678
extraArgs: []
679
logging:
680
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
681
level: info
682
# -- Set the glog logging level
683
globallevel: "0"
684
# -- Set the logging format (one of: `text`, `json`)
685
format: "text"
686
# -- Volume to be mounted in Pods for temporary files.
687
tmpVolume:
688
emptyDir: {}
689
# -- Additional volume mounts to the server main container.
690
volumeMounts: []
691
# -- Additional volumes to the server pod.
692
volumes: []
693
## Ingress configuration.
694
# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
695
ingress:
696
# -- Enable an ingress resource
697
enabled: false
698
# -- Additional ingress annotations
699
annotations: {}
700
# -- Additional ingress labels
701
labels: {}
702
# -- Defines which ingress controller will implement the resource
703
ingressClassName: ""
704
# -- List of ingress hosts
705
## Hostnames must be provided if Ingress is enabled.
706
## Secrets must be manually created in the namespace
707
hosts: []
708
# - argoworkflows.example.com
709
710
# -- List of ingress paths
711
paths:
712
- /
713
# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`
714
pathType: Prefix
715
# -- Additional ingress paths
716
extraPaths: []
717
# - path: /*
718
# backend:
719
# serviceName: ssl-redirect
720
# servicePort: use-annotation
721
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
722
# - path: /*
723
# pathType: Prefix
724
# backend:
725
# service
726
# name: ssl-redirect
727
# port:
728
# name: use-annotation
729
730
# -- Ingress TLS configuration
731
tls: []
732
# - secretName: argoworkflows-example-tls
733
# hosts:
734
# - argoworkflows.example.com
735
## Create a Google Backendconfig for use with the GKE Ingress Controller
736
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
737
GKEbackendConfig:
738
# -- Enable BackendConfig custom resource for Google Kubernetes Engine
739
enabled: false
740
# -- [BackendConfigSpec]
741
spec: {}
742
# spec:
743
# iap:
744
# enabled: true
745
# oauthclientCredentials:
746
# secretName: argoworkflows-secret
747
748
## Create a Google Managed Certificate for use with the GKE Ingress Controller
749
## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
750
GKEmanagedCertificate:
751
# -- Enable ManagedCertificate custom resource for Google Kubernetes Engine.
752
enabled: false
753
# -- Domains for the Google Managed Certificate
754
domains:
755
- argoworkflows.example.com
756
## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller
757
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters
758
GKEfrontendConfig:
759
# -- Enable FrontConfig custom resource for Google Kubernetes Engine
760
enabled: false
761
# -- [FrontendConfigSpec]
762
spec: {}
763
# spec:
764
# redirectToHttps:
765
# enabled: true
766
# responseCodeName: RESPONSE_CODE
767
768
# Gateway API HTTPRoute configuration
769
# NOTE: Gateway API support is in EXPERIMENTAL status
770
# Support depends on your Gateway controller implementation
771
# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)
772
# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details
773
httproute:
774
# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)
775
enabled: false
776
# -- Additional HTTPRoute labels
777
labels: {}
778
# -- Additional HTTPRoute annotations
779
annotations: {}
780
# -- Gateway API parentRefs for the HTTPRoute
781
## Must reference an existing Gateway
782
# @default -- `[]` (See [values.yaml])
783
parentRefs: []
784
# - name: example-gateway
785
# namespace: example-gateway-namespace
786
# sectionName: https
787
# -- List of hostnames for the HTTPRoute
788
# @default -- `[]` (See [values.yaml])
789
hostnames: []
790
# - argoworkflows.example.com
791
# -- HTTPRoute rules configuration
792
# @default -- `[]` (See [values.yaml])
793
rules:
794
- matches:
795
- path:
796
type: PathPrefix
797
value: /
798
# filters: []
799
# - type: RequestHeaderModifier
800
# requestHeaderModifier:
801
# add:
802
# - name: X-Custom-Header
803
# value: custom-value
804
# timeouts:
805
# request: 10s
806
# backendRequest: 2s
807
# Gateway API BackendTLSPolicy configuration
808
# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status
809
# Required for HTTPS backends when using Gateway API
810
# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)
811
backendTLSPolicy:
812
# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)
813
enabled: false
814
# -- Additional BackendTLSPolicy labels
815
labels: {}
816
# -- Additional BackendTLSPolicy annotations
817
annotations: {}
818
# -- Target references for the BackendTLSPolicy
819
# @default -- `[]` (See [values.yaml])
820
targetRefs: []
821
# - group: ""
822
# kind: Service
823
# name: argo-workflows-server
824
# sectionName: https
825
# -- TLS validation configuration
826
# @default -- `{}` (See [values.yaml])
827
validation: {}
828
# hostname: argo-workflows-server.argo.svc.cluster.local
829
# caCertificateRefs:
830
# - name: example-ca-cert
831
# group: ""
832
# kind: ConfigMap
833
# wellKnownCACertificates: System
834
clusterWorkflowTemplates:
835
# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
836
enabled: true
837
# -- Give the server permissions to edit ClusterWorkflowTemplates.
838
enableEditing: true
839
# SSO configuration when SSO is specified as a server auth mode.
840
sso:
841
# -- Create SSO configuration. If you set `true` , please also set `.Values.server.authModes` as `sso`.
842
enabled: false
843
# -- The root URL of the OIDC identity provider
844
issuer: https://accounts.google.com
845
clientId:
846
# -- Name of secret to retrieve the app OIDC client ID
847
name: argo-server-sso
848
# -- Key of secret to retrieve the app OIDC client ID
849
key: client-id
850
clientSecret:
851
# -- Name of a secret to retrieve the app OIDC client secret
852
name: argo-server-sso
853
# -- Key of a secret to retrieve the app OIDC client secret
854
key: client-secret
855
# -- The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.
856
redirectUrl: ""
857
rbac:
858
# -- Adds ServiceAccount Policy to server (Cluster)Role.
859
enabled: true
860
# -- Whitelist to allow server to fetch Secrets
861
## When present, restricts secrets the server can read to a given list.
862
## You can use it to restrict the server to only be able to access the
863
## service account token secrets that are associated with service accounts
864
## used for authorization.
865
secretWhitelist: []
866
# -- Scopes requested from the SSO ID provider
867
## The 'groups' scope requests group membership information, which is usually used for authorization decisions.
868
scopes: []
869
# - groups
870
# -- Define how long your login is valid for (in hours)
871
## If omitted, defaults to 10h.
872
sessionExpiry: ""
873
# -- Alternate root URLs that can be included for some OIDC providers
874
issuerAlias: ""
875
# -- Override claim name for OIDC groups
876
customGroupClaimName: ""
877
# -- Specify the user info endpoint that contains the groups claim
878
## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta)
879
userInfoPath: ""
880
# -- Skip TLS verification for the HTTP client
881
insecureSkipVerify: false
882
# -- Filter the groups returned by the OIDC provider
883
## A logical "OR" is used between each regex in the list
884
filterGroupsRegex: []
885
# - ".*argo-wf.*"
886
# - ".*argo-workflow.*"
887
# -- Extra containers to be added to the server deployment
888
extraContainers: []
889
# -- Enables init containers to be added to the server deployment
890
extraInitContainers: []
891
# -- Specify postStart and preStop lifecycle hooks for server container
892
lifecycle: {}
893
# -- terminationGracePeriodSeconds for container lifecycle hook
894
terminationGracePeriodSeconds: 30
895
## livenessProbe for server
896
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
897
livenessProbe:
898
# -- Enable Kubernetes liveness probe for server
899
enabled: false
900
httpGet:
901
# -- Http port to use for the liveness probe
902
port: 2746
903
# -- Http path to use for the liveness probe
904
path: /
905
# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded
906
failureThreshold: 3
907
# -- Number of seconds after the container has started before [probe] is initiated
908
initialDelaySeconds: 10
909
# -- How often (in seconds) to perform the [probe]
910
periodSeconds: 10
911
# -- Number of seconds after which the [probe] times out
912
timeoutSeconds: 1
913
# -- Minimum consecutive successes for the [probe] to be considered successful after having failed
914
successThreshold: 1
915
# -- Array of extra K8s manifests to deploy
916
extraObjects: []
917
# - apiVersion: secrets-store.csi.x-k8s.io/v1
918
# kind: SecretProviderClass
919
# metadata:
920
# name: argo-server-sso
921
# spec:
922
# provider: aws
923
# parameters:
924
# objects: |
925
# - objectName: "argo/server/sso"
926
# objectType: "secretsmanager"
927
# jmesPath:
928
# - path: "client_id"
929
# objectAlias: "client_id"
930
# - path: "client_secret"
931
# objectAlias: "client_secret"
932
# secretObjects:
933
# - data:
934
# - key: client_id
935
# objectName: client_id
936
# - key: client_secret
937
# objectName: client_secret
938
# secretName: argo-server-sso-secrets-store
939
# type: Opaque
940
941
# -- Use static credentials for S3 (eg. when not using AWS IRSA)
942
useStaticCredentials: true
943
artifactRepository:
944
# -- Archive the main container logs as an artifact
945
archiveLogs: false
946
# -- Store artifact in a S3-compliant object store
947
# @default -- See [values.yaml]
948
s3: {}
949
# # Note the `key` attribute is not the actual secret, it's the PATH to
950
# # the contents in the associated secret, as defined by the `name` attribute.
951
# accessKeySecret:
952
# name: "{{ .Release.Name }}-minio"
953
# key: accesskey
954
# secretKeySecret:
955
# name: "{{ .Release.Name }}-minio"
956
# key: secretkey
957
# sessionTokenSecret:
958
# name: "{{ .Release.Name }}-minio"
959
# key: sessionToken
960
# # insecure will disable TLS. Primarily used for minio installs not configured with TLS
961
# insecure: false
962
# caSecret:
963
# name: ca-root
964
# key: cert.pem
965
# bucket:
966
# endpoint:
967
# region:
968
# roleARN:
969
# useSDKCreds: true
970
# encryptionOptions:
971
# enableEncryption: true
972
# -- Store artifact in a GCS object store
973
# @default -- `{}` (See [values.yaml])
974
gcs: {}
975
# bucket: <project>-argo
976
# keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}"
977
# # serviceAccountKeySecret is a secret selector.
978
# # It references the k8s secret named 'my-gcs-credentials'.
979
# # This secret is expected to have the key 'serviceAccountKey',
980
# # containing the base64 encoded credentials
981
# # to the bucket.
982
# #
983
# # If it's running on GKE and Workload Identity is used,
984
# # serviceAccountKeySecret is not needed.
985
# serviceAccountKeySecret:
986
# name: my-gcs-credentials
987
# key: serviceAccountKey
988
# -- Store artifact in Azure Blob Storage
989
# @default -- `{}` (See [values.yaml])
990
azure: {}
991
# endpoint: https://mystorageaccountname.blob.core.windows.net
992
# container: my-container-name
993
# blobNameFormat: path/in/container
994
# # accountKeySecret is a secret selector.
995
# # It references the k8s secret named 'my-azure-storage-credentials'.
996
# # This secret is expected to have the key 'account-access-key',
997
# # containing the base64 encoded credentials to the storage account.
998
# # If a managed identity has been assigned to the machines running the
999
# # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)
1000
# # then accountKeySecret is not needed, and useSDKCreds should be
1001
# # set to true instead:
1002
# useSDKCreds: true
1003
# accountKeySecret:
1004
# name: my-azure-storage-credentials
1005
# key: account-access-key
1006
# -- The section of custom artifact repository.
1007
# Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure)
1008
customArtifactRepository: {}
1009
# artifactory:
1010
# repoUrl: https://artifactory.example.com/raw
1011
# usernameSecret:
1012
# name: artifactory-creds
1013
# key: username
1014
# passwordSecret:
1015
# name: artifactory-creds
1016
# key: password
1017
1018
# -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/).
1019
# Each map key is the name of configmap
1020
# @default -- `{}` (See [values.yaml])
1021
artifactRepositoryRef: {}
1022
# # -- 1st ConfigMap
1023
# # If you want to use this config map by default, name it "artifact-repositories".
1024
# # Otherwise, you can provide a reference to a
1025
# # different config map in `artifactRepositoryRef.configMap`.
1026
# artifact-repositories:
1027
# # -- v3.0 and after - if you want to use a specific key, put that key into this annotation.
1028
# annotations:
1029
# workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository
1030
# # 1st data of configmap. See above artifactRepository or customArtifactRepository.
1031
# default-v1-s3-artifact-repository:
1032
# archiveLogs: false
1033
# s3:
1034
# bucket: my-bucket
1035
# endpoint: minio:9000
1036
# insecure: true
1037
# accessKeySecret:
1038
# name: my-minio-cred
1039
# key: accesskey
1040
# secretKeySecret:
1041
# name: my-minio-cred
1042
# key: secretkey
1043
# # 2nd data
1044
# oss-artifact-repository:
1045
# archiveLogs: false
1046
# oss:
1047
# endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com
1048
# bucket: $mybucket
1049
# # accessKeySecret and secretKeySecret are secret selectors.
1050
# # It references the k8s secret named 'bucket-workflow-artifect-credentials'.
1051
# # This secret is expected to have the keys 'accessKey'
1052
# # and 'secretKey', containing the base64 encoded credentials
1053
# # to the bucket.
1054
# accessKeySecret:
1055
# name: $mybucket-credentials
1056
# key: accessKey
1057
# secretKeySecret:
1058
# name: $mybucket-credentials
1059
# key: secretKey
1060
# # 2nd ConfigMap
1061
# another-artifact-repositories:
1062
# annotations:
1063
# workflows.argoproj.io/default-artifact-repository: gcs
1064
# gcs:
1065
# bucket: my-bucket
1066
# keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}}
1067
# serviceAccountKeySecret:
1068
# name: my-gcs-credentials
1069
# key: serviceAccountKey
1070
1071
emissary:
1072
# -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used.
1073
## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary
1074
images: []
1075
# argoproj/argosay:v2:
1076
# cmd: [/argosay]
1077
# docker/whalesay:latest:
1078
# cmd: [/bin/bash]
1079
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.