argo-workflows

Argo Workflows

Chainguard's redistribution of the Argo Workflows Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace argo-workflows

Installation

helm install argo-workflows oci://cgr.dev/ORGANIZATION/charts/argo-workflows \
  --namespace argo-workflows \
  --create-namespace \
  --set images.pullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream Argo Workflows Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://argo-workflows.readthedocs.io/

Chainguard Customizations

The upstream chart installs the full CRDs (crds.full=true, the default) through a pre-install and pre-upgrade Job that runs a dedicated CRD installer image bundling the CRD manifests. Chainguard does not currently publish this image, and this chart maps the Job's image (crds.upgradeJob.image) to the Chainguard kubectl image, which does not carry the manifests. As a result the Job runs the kubectl image with no manifests to apply, so the full CRDs are not installed on install or upgrade.

Until a dedicated image is available, install the CRDs with one of the following:

• Use the minified CRDs, which the chart applies directly without the Job. This omits the full OpenAPI schemas:

  crds:
    full: false

• Or, for the full CRDs, build a small CRD installer image on a Chainguard base and point the Job at it (use the kubectl-fips base for a FIPS posture). The image bundles the upstream CRD manifests (from the argo-workflows repo, manifests/base/crds/full/argoproj.io_*.yaml, at the tag matching your app version) and applies them with server-side apply, which is required because the full CRDs exceed the client-side apply size limit:

  FROM cgr.dev/chainguard/kubectl:latest
  COPY argoproj.io_*.yaml /crds/full/
  ENTRYPOINT ["kubectl","apply","--server-side","--force-conflicts","-f","/crds/full/"]

  Push the image to your registry and point the Job at it, matching the tag to your app version:

  crds:
    full: true
    upgradeJob:
      image:
        registry: <your-registry>
        repository: <your-crd-installer-image>
        tag: <version>