How do I reference an artifact output from a previous step that ran in a loop?

[dbeilin]

I have this workflow:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: zap-scanner-
spec:
  serviceAccountName: argo-workflows-server

  entrypoint: main

  arguments:
    parameters:
      - name: urls
        value: |
          [
            { "name": "url1", "url": "https://url1.com" },
            { "name": "url2", "url": "https://url2.com" }
          ]

  templates:
    - name: main
      dag:
        tasks:
          - name: zap-scanner
            template: zap-scanner-tmpl
            arguments:
              parameters:
                - name: name
                  value: "{{item.name}}"
                - name: url
                  value: "{{item.url}}"
            withParam: "{{workflow.parameters.urls}}"

          - name: falco-import
            dependencies: ["zap-scanner"]
            templateRef:
              name: falco-import-template
              template: falco-import-tmpl
              clusterScope: true
            continueOn:
              failed: true
            arguments:
              parameters:
                - name: report-type
                  value: "--zap-report"
              artifacts:
                - name: json-report
                  from: "{{tasks.zap-scanner.outputs.artifacts.json-report}}"
            withParam: "{{workflow.parameters.urls}}"

    - name: zap-scanner-tmpl
      inputs:
        parameters:
          - name: name
          - name: url
      outputs:
        artifacts:
          - name: json-report
            path: /zap/wrk/{{inputs.parameters.name}}_report.json
            s3:
              key: "{{workflow.name}}/json_report.tgz"
      script:
      ...
      ...

I have a Template Workflow that needs an artifact as an input. The zap-scanner step outputs an artifact, which I'm trying to input to the falco-import step.
However I just get:

Unable to resolve: "tasks.zap-scanner.outputs.artifacts.json-report"

I'm not sure how to reference the output from my zap-scanner step.

[sblack-usu]

Think of the artifacts as a mount (folder path) in your container. It doesn't make sense to pass an artifact as a parameter. You need to mount the same artifact (bucket and object path) to an appropriate file path within the second step container. That is defined in the falco-import-template that you reference, under inputs just like you are doing with the output artifact for the zap-scanner-tmp.

[dbeilin]

Thanks for the answer. The alternative for me was to use an explicit path to my key in the bucket, but I have a similar workflow the works using the same method of just referencing the artifact:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: container-vulnerability-scanner-
spec:
  serviceAccountName: argo-workflows-server
  entrypoint: main

  templates:
    - name: main
      steps:
        - - name: scan
            template: scan-tmpl

        - - name: falco-import
            continueOn:
              failed: true
            templateRef:
              name: falco-import-template
              template: falco-import-tmpl
              clusterScope: true
            arguments:
              parameters:
                - name: report-type
                  value: "--trivy-report"
              artifacts:
                - name: json-report
                  from: "{{steps.scan.outputs.artifacts.json-report}}"

    - name: scan-tmpl
      outputs:
        artifacts:
          - name: report
            path: /tmp/report.json
            s3:
              key: "{{workflow.name}}/report.json"
      script:
        image: aquasec/trivy
        command: [/bin/sh]
        source: |
          SERVICE="nginx"
          IMAGE_SHA="latest"

          echo "Scanning $SERVICE:$IMAGE_SHA"

          trivy image \
            --format json \
            --output /tmp/report.json \
            --timeout 600s \
            $SERVICE:$IMAGE_SHA

Here I also don't use a path, just from: "{{steps.scan.outputs.artifacts.json-report}}".

Just to provide more context, the Cluster Template I'm referencing accepts these params:

apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: falco-import-template
  namespace: argo
spec:
  serviceAccountName: argo-workflows-server
  templates:
    - name: falco-import-tmpl
      inputs:
        parameters:
          - name: report-type
        artifacts:
          - name: json-report
            path: /tmp/report.json

I found this method in one of the examples.

[sblack-usu]

I haven't seen or tried this method, today I learned.