en/stable/http-template/

[giscus[bot]]

en/stable/http-template/

https://argo-workflows.readthedocs.io/en/stable/http-template/

[PhamQuang-512]

what is mean by saying "In order to use the Argo Agent, you will need to ensure that you have added the appropriate workflow RBAC to add an agent role with to Argo Workflows" ?

[wesleyscholl]

@PhamQuang-512

I wrote an article about http template RBAC last year for my company, hope it helps.

Argo Workflows: How To Setup And Test The HTTP Template

⚙️ RBAC (Role Based Access Control) Configuration

1. Create a service account Secret.

apiVersion: v1
kind: Secret
metadata:
  name: argo.service-account-token
  annotations:
    kubernetes.io/service-account.name: argo
type: kubernetes.io/service-account-token

This creates a Kubernetes Secret named argo.service-account-token associated with the argo service account. This Secret holds the service account token for the argo service account, which will be used for authentication when the Argo workflow needs to interact with other resources or services.

2. Create a Role for the service account.

Create a Role that can interact with WorkflowTaskSets. The http template is a task set, meaning it can have multiple steps or retries. These task sets require additional permissions.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: patch-workflowtasksets
  namespace: argo
rules:
- apiGroups:
  - argoproj.io
  resources:
  - workflowtasksets/status
  verbs:
  - get
  - list
  - watch
  - patch

This Role manifest creates a Role named patch-workflowtasksets within the argo namespace. This Role grants permissions to get, list, watch, and update the status of WorkflowTaskSets within the Argo Workflows API.

3. Create a RoleBinding for the service account.

Lastly, bind the patch-workflowtasksets Role to the argo service account.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-patch-workflowtasksets
  namespace: argo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: patch-workflowtasksets
subjects:
- kind: ServiceAccount
  name: argo
  namespace: argo

This RoleBinding manifest allows the Argo Workflows controller, running under the argo ServiceAccount, to access and update the status of WorkflowTaskSets within the Argo Workflows API. This is a critical step for the operation of the Argo Workflows http template. The RoleBinding allows the controller to track and manage the execution of workflows.

Resources:

• HTTP Template Argo Workflows Docs - HTTP Template - Argo Workflows - The workflow engine for Kubernetes
• Argo Workflows RBAC - Workflow RBAC - Argo Workflows - The workflow engine for Kubernetes
• HTTP Template Detailed Explanation and Examples - https://medium.chuklee.com/argo-workflow-resource-and-http-template-46a4855fb3e7

[gustavo-sdo]

@wesleyscholl
Thank you for taking the time to write this tutorial. It was incredibly helpful to me!

The official documentation doesn’t provide a solution as clear as yours for using the HTTP template.

It's not trivial at all to get this working.

Additionally, until this solution is applied, the workflow step that uses the HTTP template remains stuck in a "Pending" state indefinitely. No errors appear in the argo-workflow-controller logs, which makes debugging the issue quite challenging.

[wesleyscholl]

@gustavo-sdo @PhamQuang-512

The error shows in the notification tab after clicking the menu buttons and toggles a few times.

Click the notification button.

Click show all and hide normal.

I will work with the Argo Workflows team to get the http documentation updated.