Argo: Open source Kubernetes native workflows, events, CI and CD
argoproj.github.io
Argo: Open source Kubernetes native workflows, events, CI and CD
1–10 of 21 posts
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#2The idea is nice, but if security is one of your concerns, you'll probably not want to run this if the docs are even close to representative of the actual application:
> 3. Configure the service account to run workflows
> For clusters with RBAC enabled, the 'default' service account is too limited to support features like artifacts, outputs, access to secrets, etc... Run the following command to grant admin privileges to the 'default' service account in the namespace 'default'
This raises so many red flags. Never give admin rights 'as a default'.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#3The idea is nice, but if security is one of your concerns, you'll probably not want to run this if the docs are even close to representative of the actual application: > 3. Configure the service account to run workflows > For clusters with RBAC enabled, the 'default' service account is too limited to support features like artifacts, outputs, access to secrets, etc... Run the following command to grant admin privilege…
While I agree with your position that admin rights should not be the default, that doesn't seem to be what Argo is actually doing.
The text snippet you've included is from the quick start/demo page, which seems to be targeted at getting the examples running quickly so that a potential user can see what it is capable of. Other issues for this in a production setup would be the use of the 'default' role/namespace at all. In this use case (running the examples in a new cluster), giving the default user full access is the quickest way to this result.
Clearly it would be better if Argo included a more precise (permission wise) role by default, but from my understanding Argo does not require cluster admin permissions in order to function.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#4The idea is nice, but if security is one of your concerns, you'll probably not want to run this if the docs are even close to representative of the actual application: > 3. Configure the service account to run workflows > For clusters with RBAC enabled, the 'default' service account is too limited to support features like artifacts, outputs, access to secrets, etc... Run the following command to grant admin privilege…
While I agree with your position that admin rights should not be the default, that doesn't seem to be what Argo is actually doing. The text snippet you've included is from the quick start/demo page, which seems to be targeted at getting the examples running quickly so that a potential user can see what it is capable of. Other issues for this in a production setup would be the use of the 'default' role/namespace at al…
The parent post did quality it appropriately with "if the docs are even close to representative of the actual application".
I hope the docs are not representative, but the parent post is right that it's a bad sign. At least put up a warning sign that it's insecure and only suitable for demo purposes to do that.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#5The idea is nice, but if security is one of your concerns, you'll probably not want to run this if the docs are even close to representative of the actual application: > 3. Configure the service account to run workflows > For clusters with RBAC enabled, the 'default' service account is too limited to support features like artifacts, outputs, access to secrets, etc... Run the following command to grant admin privilege…
And right below that it says:
>NOTE: You can also submit workflows which run with a different service account using:
>argo submit --serviceaccount
To which there is further documentation as to the exact permissions you need. While I only spent about 30 seconds searching, this gets you 90% of the way there from what I can tell on my phone.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#6What does this project simplify?
It seems to be equivalently complex to the process it would have you replace.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#7We're using Argo as a replacement for our GoCD based continuous delivery system and it's been fantastic. We were about to move onto Concourse and realized we would need to set up the and manage the equivalent of a Kubernetes cluster just to support it. We took a few extra weeks to prototype Argo first and were glad we did.
In our use case, the primary deployment model is blue/green deploys of VM based microservices on AWS with a bunch of Terraform managed infrastructure gluing them together. The newer class of service we're developing right now is container based and has even more infrastructure complexity. Teams manage their own service releases and each group has slight variations in their deploy steps. We need a deploy system that can support the old and new style and remain flexible while providing a migration path.
Teams love the flexibility and expressiveness of the workflow definitions. They've begun to move cron jobs onto it as well. Argo is much more lightweight and easy to operate than any other system we had worked with because it leans so heavily on Kubernetes primitives that we already needed to understand. The codebase is also relatively easy to understand, so we've been able to contribute things back to the project while working through the migration.
We've taken a cue from the project and begun to consolidate our control plane on CRDs so they can seamlessly integrate with Argo. CRD Operators + Argo are allowing us to consolidate all of the custom deploy/config tooling we built over the years onto a common system that is testable and well integrated.
It's a little early in the project to measure the full effect, but the internal project has a lot of momentum.
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#8We've had much success with Argo workflows over the past months. Among other projects, we use it to generate city-sized extracts of mapping data from the OpenStreetMap planet. Blog post at https://www.interline.io/blog/scaling-openstreetmap-data-wor...
Using Argo on Google Kubernetes Engine makes it easy to auto-scale for our workflow steps that parallelize. We're also able to reuse Dockerfiles and resources between both our batch workflows and our running services (also on Kubernetes).
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#9FYI, Google's new Kubeflow Pipelines service uses Argo.
https://cloud.google.com/blog/products/ai-machine-learning/i...
Re: Argo: Open source Kubernetes native workflows, events, CI and CD
#10The idea is nice, but if security is one of your concerns, you'll probably not want to run this if the docs are even close to representative of the actual application: > 3. Configure the service account to run workflows > For clusters with RBAC enabled, the 'default' service account is too limited to support features like artifacts, outputs, access to secrets, etc... Run the following command to grant admin privilege…
I work on Argo. Those instructions are mainly for demo purposes because many of the examples need admin privileges. The amount of access which is needed, is really dependent on what your workflow is doing (e.g. if your workflow needs to deploy a resource, then you need to give the service account 'create' privileges on that resource). Currently, the bare minimum for a workflow to function is outlined here:
https://github.com/argoproj/argo/issues/983#issuecomment-435...
I will make sure that the docs are updated, so that this information is well understood.