argo-workflows

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

images:

# -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`.

tag: ""

# -- imagePullPolicy to apply to all containers

pullPolicy: Always

# -- Secrets with credentials to pull images from a private registry

pullSecrets: []

# - name: argo-pull-secret

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.

# Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.

full: true

# -- Annotations to be added to all CRDs (only applies when crds.full=false)

annotations: {}

# Configuration for the CRD install Job (only used when crds.full=true)

upgradeJob:

# -- Image for the container that applies the full CRDs. It bundles the CRDs for its own tag, so keep it in step with the app version.

## Ref: https://argo-workflows.readthedocs.io/en/latest/crd-installer/

image:

# -- Registry to use for the CRD installer

registry: cgr.dev

# -- Repository to use for the CRD installer

repository: chainguard-private/kubectl

# -- Image tag for the CRD installer. Defaults to `.Values.images.tag`.

tag: 1.36.4@sha256:a8bd37313032f36c16bff404fd4ae98247982f3f4e9c62e3c0f619b858513f61

# -- Resources for the CRD install Job containers

resources: {}

# -- Node selector for the CRD install Job

nodeSelector: {}

# -- Pod security context for the CRD install Job pod

podSecurityContext: {}

# -- Optional labels to add to the CRD install Job pod

podLabels: {}

# -- Tolerations for the CRD install Job

tolerations: []

# -- Image pull secrets for the CRD install Job

# @default -- `.Values.images.pullSecrets`

imagePullSecrets: []

# -- Security context for the CRD install Job container

securityContext:

readOnlyRootFilesystem: true

runAsNonRoot: true

allowPrivilegeEscalation: false

runAsUser: 8737

runAsGroup: 8737

seccompProfile:

type: RuntimeDefault

capabilities:

drop:

- ALL

# -- Extra environment variables to provide to the CRD install Job container

extraEnv: []

# -- Create ClusterRoles that extend existing ClusterRoles to interact with Argo Workflows CRDs.

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: true

# -- String to partially override "argo-workflows.fullname" template

nameOverride:

# -- String to fully override "argo-workflows.fullname" template

fullnameOverride:

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Labels to set on all resources

commonLabels: {}

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

apiVersionOverrides:

# -- String to override apiVersion of autoscaling rendered by this helm chart

autoscaling: "" # autoscaling/v2

# -- String to override apiVersion of GKE resources rendered by this helm chart

cloudgoogle: "" # cloud.google.com/v1

# -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart

monitoring: "" # monitoring.coreos.com/v1

# -- Restrict Argo to operate only in a single namespace (the namespace of the

# Helm release) by apply Roles and RoleBindings instead of the Cluster

# equivalents, and start workflow-controller with the --namespaced flag. Use it

# in clusters with strict access policy.

singleNamespace: false

workflow:

# -- Deprecated; use controller.workflowNamespaces instead.

namespace:

serviceAccount:

# -- Specifies whether a service account should be created

create: false

# -- Specifies whether a secret for each service account should be created

createSecret: false

# -- Labels applied to created service account

labels: {}

# -- Annotations applied to created service account

annotations: {}

# -- Service account which is used to run workflows

# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`

100

pullSecrets: []

101

rbac:

102

# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.

103

# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)

104

create: true

105

# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates

106

agentPermissions: false

107

# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc

108

artifactGC: false

109

# -- Extra service accounts to be added to the RoleBinding

110

serviceAccounts: []

111

# - name: my-service-account

112

# namespace: my-namespace

113

# -- Additional rules for the service account that runs the workflows.

114

rules: []

115

controller:

116

image:

117

# -- Registry to use for the controller

118

registry: cgr.dev

119

# -- Registry to use for the controller

120

repository: chainguard-private/argo-workflowcontroller

121

# -- Image tag for the workflow controller. Defaults to `.Values.images.tag`.

122

tag: 4.1.2@sha256:f5b179c29dc677f5b0728ec7191fb84c91e4920f924bf9a720dbd0cbf9b0512e

123

# -- parallelism dictates how many workflows can be running at the same time

124

parallelism:

125

# -- Globally limits the rate at which pods are created.

126

# This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of

127

# parallel nodes.

128

resourceRateLimit: {}

129

# limit: 10

130

# burst: 1

131

132

rbac:

133

# -- Adds Role and RoleBinding for the controller.

134

create: true

135

# -- Allows controller to get, list, and watch certain k8s secrets

136

secretWhitelist: []

137

# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.

138

accessAllSecrets: false

139

# -- Allows controller to create and update ConfigMaps. Enables memoization feature

140

writeConfigMaps: false

141

configMap:

142

# -- Create a ConfigMap for the controller

143

create: true

144

# -- ConfigMap name

145

146

# -- ConfigMap annotations

147

annotations: {}

148

# -- Limits the maximum number of incomplete workflows in a namespace

149

namespaceParallelism:

150

# -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224

151

initialDelay:

152

# -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment

153

deploymentAnnotations: {}

154

# -- podAnnotations is an optional map of annotations to be applied to the controller Pods

155

podAnnotations: {}

156

# -- Optional labels to add to the controller pods

157

podLabels: {}

158

# -- SecurityContext to set on the controller pods

159

podSecurityContext: {}

160

# podPortName: http

161

metricsConfig:

162

# -- Enables prometheus metrics server

163

enabled: false

164

# -- Path is the path where metrics are emitted. Must start with a "/".

165

path: /metrics

166

# -- Frequency at which prometheus scrapes metrics

167

interval: 30s

168

# -- Port is the port where metrics are emitted

169

port: 9090

170

# -- How often custom metrics are cleared from memory

171

metricsTTL: ""

172

# -- Flag that instructs prometheus to ignore metric emission errors.

173

ignoreErrors: false

174

# -- Flag that use a self-signed cert for TLS

175

secure: false

176

# -- Container metrics port name

177

portName: metrics

178

# -- Service metrics port

179

servicePort: 8080

180

# -- Service metrics port name

181

servicePortName: metrics

182

# -- serviceMonitor scheme

183

scheme: http

184

# -- Flag to enable headless service

185

headlessService: false

186

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

187

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#honorlabels

188

honorLabels: false

189

# -- ServiceMonitor relabel configs to apply to samples before scraping

190

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig

191

relabelings: []

192

# -- ServiceMonitor metric relabel configs to apply to samples before ingestion

193

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint

194

metricRelabelings: []

195

# -- ServiceMonitor will add labels from the service to the Prometheus metric

196

## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec

197

targetLabels: []

198

# -- Manipulate the metrics created by the workflow controller

199

## Ref: https://argo-workflows.readthedocs.io/en/latest/metrics/#modifiers

200

modifiers: {}

201

# -- the controller container's securityContext

202

securityContext:

203

readOnlyRootFilesystem: true

204

runAsNonRoot: true

205

allowPrivilegeEscalation: false

206

capabilities:

207

drop:

208

- ALL

209

# -- enable Workflow Archive to store the status of workflows. Postgres, MySQL (>= 5.7.8) and MariaDB (>= 10.2.7, requires Argo Workflows v4.1+) are available.

210

## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/

211

persistence: {}

212

# connectionPool:

213

# maxIdleConns: 100

214

# maxOpenConns: 0

215

# # save the entire workflow into etcd and DB

216

# nodeStatusOffLoad: false

217

# # enable archiving of old workflows

218

# archive: false

219

# postgresql:

220

# host: localhost

221

# port: 5432

222

# database: postgres

223

# tableName: argo_workflows

224

# # the database secrets must be in the same namespace of the controller

225

# userNameSecret:

226

# name: argo-postgres-config

227

# key: username

228

# passwordSecret:

229

# name: argo-postgres-config

230

# key: password

231

# # Instead of passwordSecret, Postgres can authenticate with a token.

232

# # Requires Argo Workflows v4.1+; userNameSecret is still required.

233

# # Microsoft Entra ID (needs Azure Workload Identity on the controller's service account):

234

# azureToken:

235

# enabled: true

236

# scope: https://ossrdbms-aad.database.windows.net/.default

237

# # AWS RDS IAM authentication (needs IRSA or EKS Pod Identity on the controller's service account):

238

# awsRDSToken:

239

# enabled: true

240

# region: us-east-1

241

# ssl: true

242

# # sslMode must be one of: disable, require, verify-ca, verify-full

243

# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq

244

# sslMode: require

245

# mysql:

246

# host: localhost

247

# port: 3306

248

# database: argo

249

# tableName: argo_workflows

250

# userNameSecret:

251

# name: argo-mysql-config

252

# key: username

253

# passwordSecret:

254

# name: argo-mysql-config

255

# key: password

256

257

# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.

258

# Only valid for 2.7+

259

## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/

260

workflowDefaults: {}

261

# spec:

262

# ttlStrategy:

263

# secondsAfterCompletion: 86400

264

# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/

265

# artifactRepositoryRef:

266

# configMap: my-artifact-repository # default is "artifact-repositories"

267

# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.

268

269

# -- Number of workflow workers

270

workflowWorkers: # 32

271

# -- Number of workflow TTL workers

272

workflowTTLWorkers: # 4

273

# -- Number of pod cleanup workers

274

podCleanupWorkers: # 4

275

# -- Number of cron workflow workers

276

# Only valid for 3.5+

277

cronWorkflowWorkers: # 8

278

# -- Restricts the Workflows that the controller will process.

279

# Only valid for 2.9+

280

workflowRestrictions: {}

281

# templateReferencing: Strict|Secure

282

283

# telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint

284

# as metrics by default, but can be overridden using this config.

285

telemetryConfig:

286

# -- Enables prometheus telemetry server

287

enabled: false

288

# -- telemetry path

289

path: /telemetry

290

# -- Frequency at which prometheus scrapes telemetry data

291

interval: 30s

292

# -- telemetry container port

293

port: 8081

294

# -- How often custom metrics are cleared from memory

295

metricsTTL: ""

296

# -- Flag that instructs prometheus to ignore metric emission errors.

297

ignoreErrors: false

298

# -- Flag that use a self-signed cert for TLS

299

secure: false

300

# -- telemetry service port

301

servicePort: 8081

302

# -- telemetry service port name

303

servicePortName: telemetry

304

# -- telemetry serviceMonitor scheme to use

305

scheme: http

306

serviceMonitor:

307

# -- Enable a prometheus ServiceMonitor

308

enabled: false

309

# -- Prometheus ServiceMonitor labels

310

additionalLabels: {}

311

# -- Prometheus ServiceMonitor namespace

312

namespace: "" # "monitoring"

313

serviceAccount:

314

# -- Create a service account for the controller

315

create: true

316

# -- Service account name

317

318

# -- Labels applied to created service account

319

labels: {}

320

# -- Annotations applied to created service account

321

annotations: {}

322

# -- Workflow controller name string

323

324

# -- Specify all namespaces where this workflow controller instance will manage

325

# workflows. This controls where the service account and RBAC resources will

326

# be created. Only valid when singleNamespace is false.

327

workflowNamespaces:

328

- default

329

instanceID:

330

# -- Configures the controller to filter workflow submissions

331

# to only those which have a matching instanceID attribute.

332

## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`

333

## or `instanceID.explicitID` must be defined.

334

enabled: false

335

# -- Use ReleaseName as instanceID

336

useReleaseName: false

337

# useReleaseName: true

338

339

# -- Use a custom instanceID

340

explicitID: ""

341

# explicitID: unique-argo-controller-identifier

342

logging:

343

# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)

344

level: info

345

# -- Set the glog logging level

346

globallevel: "0"

347

# -- Set the logging format (one of: `text`, `json`)

348

format: "text"

349

# -- Service type of the controller Service

350

serviceType: ClusterIP

351

# -- Annotations to be applied to the controller Service

352

serviceAnnotations: {}

353

# -- Optional labels to add to the controller Service

354

serviceLabels: {}

355

# -- The class of the load balancer implementation

356

loadBalancerClass: ""

357

# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`

358

loadBalancerSourceRanges: []

359

# -- Resource limits and requests for the controller

360

resources: {}

361

# -- Configure liveness [probe] for the controller

362

# @default -- See [values.yaml]

363

livenessProbe:

364

httpGet:

365

port: 6060

366

path: /healthz

367

failureThreshold: 3

368

initialDelaySeconds: 90

369

periodSeconds: 60

370

timeoutSeconds: 30

371

# -- Extra environment variables to provide to the controller container

372

extraEnv: []

373

# - name: FOO

374

# value: "bar"

375

376

# -- envFrom to pass to the controller container

377

envFrom: []

378

# -- Extra arguments to be added to the controller

379

extraArgs: []

380

# -- Additional volume mounts to the controller main container

381

volumeMounts: []

382

# -- Additional volumes to the controller pod

383

volumes: []

384

# -- The number of controller pods to run

385

replicas: 1

386

# -- The number of revisions to keep.

387

revisionHistoryLimit: 10

388

pdb:

389

# -- Configure [Pod Disruption Budget] for the controller pods

390

enabled: false

391

# minAvailable: 1

392

# maxUnavailable: 1

393

# -- [Node selector]

394

nodeSelector:

395

kubernetes.io/os: linux

396

# -- [Tolerations] for use with node taints

397

tolerations: []

398

# -- Assign custom [affinity] rules

399

affinity: {}

400

# -- Assign custom [TopologySpreadConstraints] rules to the workflow controller

401

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

402

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

403

topologySpreadConstraints: []

404

# - maxSkew: 1

405

# topologyKey: topology.kubernetes.io/zone

406

# whenUnsatisfiable: DoNotSchedule

407

408

# -- Leverage a PriorityClass to ensure your pods survive resource shortages.

409

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

410

priorityClassName: ""

411

# -- Configure Argo Server to show custom [links]

412

## Ref: https://argo-workflows.readthedocs.io/en/stable/links/

413

links: []

414

# -- Configure Argo Server to show custom [columns]

415

## Ref: https://github.com/argoproj/argo-workflows/pull/10693

416

columns: []

417

# -- Set ui navigation bar background color

418

navColor: ""

419

clusterWorkflowTemplates:

420

# -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.

421

enabled: true

422

# -- Extra service accounts to be added to the ClusterRoleBinding

423

serviceAccounts: []

424

# - name: my-service-account

425

# namespace: my-namespace

426

# -- Extra containers to be added to the controller deployment

427

extraContainers: []

428

# -- Enables init containers to be added to the controller deployment

429

extraInitContainers: []

430

# -- Workflow retention by number of workflows

431

retentionPolicy: {}

432

# completed: 10

433

# failed: 3

434

# errored: 3

435

436

nodeEvents:

437

# -- Enable to emit events on node completion.

438

## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events:

439

## "Unable to create audit event: etcdserver: mvcc: database space exceeded"

440

enabled: true

441

workflowEvents:

442

# -- Enable to emit events on workflow status changes.

443

## This can take up a lot of space in k8s (typically etcd), resulting in errors when trying to create new events:

444

## "Unable to create audit event: etcdserver: mvcc: database space exceeded"

445

enabled: true

446

# -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads,

447

# or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret.

448

# @default -- `{}` (See [values.yaml])

449

kubeConfig: {}

450

# # name of the kubeconfig secret, may not be empty when kubeConfig specified

451

# secretName: kubeconfig-secret

452

# # key of the kubeconfig secret, may not be empty when kubeConfig specified

453

# secretKey: kubeconfig

454

# # mounting path of the kubeconfig secret, default to /kube/config

455

# mountPath: /kubeconfig/mount/path

456

# # volume name when mounting the secret, default to kubeconfig

457

# volumeName: kube-config-volume

458

459

# -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately.

460

# @default -- `30` seconds (Kubernetes default)

461

podGCGracePeriodSeconds:

462

# -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately.

463

# @default -- `5s` (Argo Workflows default)

464

podGCDeleteDelayDuration: ""

465

# -- enable Synchronization to use a database. Postgres and MySQL (>= 5.7.8) are available.

466

## Ref: https://argo-workflows.readthedocs.io/en/latest/workflow-controller-configmap/#syncconfig

467

synchronization: {}

468

# controllerName: argo-workflows

469

# connectionPool:

470

# maxIdleConns: 100

471

# maxOpenConns: 0

472

# postgresql:

473

# host: localhost

474

# port: 5432

475

# database: postgres

476

# tableName: argo_workflows

477

# # the database secrets must be in the same namespace of the controller

478

# userNameSecret:

479

# name: argo-postgres-config

480

# key: username

481

# passwordSecret:

482

# name: argo-postgres-config

483

# key: password

484

# ssl: true

485

# # sslMode must be one of: disable, require, verify-ca, verify-full

486

# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq

487

# sslMode: require

488

# mysql:

489

# host: localhost

490

# port: 3306

491

# database: argo

492

# tableName: argo_workflows

493

# userNameSecret:

494

# name: argo-mysql-config

495

# key: username

496

# passwordSecret:

497

# name: argo-mysql-config

498

# key: password

499

500

failedPodRestart:

501

# -- Enable to restart of pods that fail before entering Running state.

502

## This is useful for recovering from transient infrastructure issues like node eviction due to DiskPressure or MemoryPressure without requiring a retryStrategy on every template.

503

## ref: https://argo-workflows.readthedocs.io/en/latest/pod-restarts/

504

enabled: false

505

# -- Maximum number of automatic restarts per node before giving up.

506

maxRestarts: 3

507

# -- Disable the creation of agent pods, which are used for HTTP and Plugin templates. When enabled, HTTP and Plugin templates will not be processed by this controller.

508

# Only valid for 4.1+

509

disableAgentPodCreation: false

510

initlessPod:

511

# -- Enable the init-less pod layout (beta), which provides the executor to workflow pods through an image volume instead of an init container.

512

# Only valid for 4.1+. Requires the `ImageVolume` feature gate on the kube-apiserver and all kubelets (beta in Kubernetes v1.33-1.35, enabled by default from v1.36).

513

## Ref: https://argo-workflows.readthedocs.io/en/latest/initless-pod/

514

enabled: false

515

# mainContainer adds default config for main container that could be overriden in workflows template

516

mainContainer:

517

# -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`.

518

imagePullPolicy: ""

519

# -- Resource limits and requests for the Workflow main container

520

resources: {}

521

# -- Adds environment variables for the Workflow main container

522

env: []

523

# -- Adds reference environment variables for the Workflow main container

524

envFrom: []

525

# -- sets security context for the Workflow main container

526

securityContext: {}

527

# executor controls how the init and wait container should be customized

528

executor:

529

image:

530

# -- Registry to use for the Workflow Executors

531

registry: cgr.dev

532

# -- Repository to use for the Workflow Executors

533

repository: chainguard-private/argo-exec

534

# -- Image tag for the workflow executor. Defaults to `.Values.images.tag`.

535

tag: 4.1.2@sha256:8820e2daacb5cd3cd881011b2af9cc98cfdd916fd7355384dfd976f8aa96e349

536

# -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`.

537

pullPolicy: ""

538

# -- Resource limits and requests for the Workflow Executors

539

resources: {}

540

# -- Passes arguments to the executor processes

541

args: []

542

# -- Adds environment variables for the executor.

543

env: []

544

# -- sets security context for the executor container

545

securityContext: {}

546

server:

547

# -- Deploy the Argo Server

548

enabled: true

549

# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.

550

## only updates base url of resources on client side,

551

## it's expected that a proxy server rewrites the request URL and gets rid of this prefix

552

## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190

553

baseHref: /

554

image:

555

# -- Registry to use for the server

556

registry: cgr.dev

557

# -- Repository to use for the server

558

repository: chainguard-private/argo-cli

559

# -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.

560

tag: 4.1.2@sha256:3ef60f624e2f7fdb22378e017e0f12f004e3c8cb70bc853bdf5124e03f3a0b1d

561

# -- optional map of annotations to be applied to the ui Deployment

562

deploymentAnnotations: {}

563

# -- optional map of annotations to be applied to the ui Pods

564

podAnnotations: {}

565

# -- Optional labels to add to the UI pods

566

podLabels: {}

567

# -- SecurityContext to set on the server pods

568

podSecurityContext: {}

569

rbac:

570

# -- Adds Role and RoleBinding for the server.

571

create: true

572

# -- Servers container-level security context

573

securityContext:

574

readOnlyRootFilesystem: false

575

runAsNonRoot: true

576

allowPrivilegeEscalation: false

577

capabilities:

578

drop:

579

- ALL

580

# -- Server name string

581

582

# -- Service type for server pods

583

serviceType: ClusterIP

584

# -- Service port for server

585

servicePort: 2746

586

# -- Service target port for server

587

serviceTargetPort: 2746

588

# -- Service node port

589

serviceNodePort: # 32746

590

# -- Service port name

591

servicePortName: "" # http

592

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

593

hostAliases: []

594

# - ip: 10.20.30.40

595

# hostnames:

596

# - git.myhostname

597

598

serviceAccount:

599

# -- Create a service account for the server

600

create: true

601

# -- Service account name

602

603

# -- Labels applied to created service account

604

labels: {}

605

# -- Annotations applied to created service account

606

annotations: {}

607

# -- Annotations to be applied to the UI Service

608

serviceAnnotations: {}

609

# -- Optional labels to add to the UI Service

610

serviceLabels: {}

611

# -- The class of the load balancer implementation

612

loadBalancerClass: ""

613

# -- Static IP address to assign to loadBalancer service type `LoadBalancer`

614

loadBalancerIP: ""

615

# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`

616

loadBalancerSourceRanges: []

617

# -- Resource limits and requests for the server

618

resources: {}

619

# -- The number of server pods to run

620

replicas: 1

621

# -- The number of revisions to keep.

622

revisionHistoryLimit: 10

623

## Argo Server Horizontal Pod Autoscaler

624

autoscaling:

625

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server

626

enabled: false

627

# -- Minimum number of replicas for the Argo Server [HPA]

628

minReplicas: 1

629

# -- Maximum number of replicas for the Argo Server [HPA]

630

maxReplicas: 5

631

# -- Average CPU utilization percentage for the Argo Server [HPA]

632

targetCPUUtilizationPercentage: 50

633

# -- Average memory utilization percentage for the Argo Server [HPA]

634

targetMemoryUtilizationPercentage: 50

635

# -- Configures the scaling behavior of the target in both Up and Down directions.

636

# This is only available on HPA apiVersion `autoscaling/v2beta2` and newer

637

behavior: {}

638

# scaleDown:

639

# stabilizationWindowSeconds: 300

640

# policies:

641

# - type: Pods

642

# value: 1

643

# periodSeconds: 180

644

# scaleUp:

645

# stabilizationWindowSeconds: 300

646

# policies:

647

# - type: Pods

648

# value: 2

649

pdb:

650

# -- Configure [Pod Disruption Budget] for the server pods

651

enabled: false

652

# minAvailable: 1

653

# maxUnavailable: 1

654

# -- [Node selector]

655

nodeSelector:

656

kubernetes.io/os: linux

657

# -- [Tolerations] for use with node taints

658

tolerations: []

659

# -- Assign custom [affinity] rules

660

affinity: {}

661

# -- Assign custom [TopologySpreadConstraints] rules to the argo server

662

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

663

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

664

topologySpreadConstraints: []

665

# - maxSkew: 1

666

# topologyKey: topology.kubernetes.io/zone

667

# whenUnsatisfiable: DoNotSchedule

668

669

# -- Leverage a PriorityClass to ensure your pods survive resource shortages

670

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

671

priorityClassName: ""

672

# -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs.

673

## See the following documentation for more details on secure mode:

674

## https://argo-workflows.readthedocs.io/en/stable/tls/

675

secure: false

676

# -- Extra environment variables to provide to the argo-server container

677

extraEnv: []

678

# - name: FOO

679

# value: "bar"

680

681

# -- envFrom to pass to the argo-server container

682

envFrom: []

683

# -- Deprecated; use server.authModes instead.

684

authMode: ""

685

# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.

686

## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/

687

authModes: []

688

# -- Extra arguments to provide to the Argo server binary.

689

## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options

690

extraArgs: []

691

logging:

692

# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)

693

level: info

694

# -- Set the glog logging level

695

globallevel: "0"

696

# -- Set the logging format (one of: `text`, `json`)

697

format: "text"

698

# -- Volume to be mounted in Pods for temporary files.

699

tmpVolume:

700

emptyDir: {}

701

# -- Additional volume mounts to the server main container.

702

volumeMounts: []

703

# -- Additional volumes to the server pod.

704

volumes: []

705

## Ingress configuration.

706

# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/

707

ingress:

708

# -- Enable an ingress resource

709

enabled: false

710

# -- Additional ingress annotations

711

annotations: {}

712

# -- Additional ingress labels

713

labels: {}

714

# -- Defines which ingress controller will implement the resource

715

ingressClassName: ""

716

# -- List of ingress hosts

717

## Hostnames must be provided if Ingress is enabled.

718

## Secrets must be manually created in the namespace

719

hosts: []

720

# - argoworkflows.example.com

721

722

# -- List of ingress paths

723

paths:

724

- /

725

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

726

pathType: Prefix

727

# -- Additional ingress paths

728

extraPaths: []

729

# - path: /*

730

# backend:

731

# serviceName: ssl-redirect

732

# servicePort: use-annotation

733

## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)

734

# - path: /*

735

# pathType: Prefix

736

# backend:

737

# service

738

# name: ssl-redirect

739

# port:

740

# name: use-annotation

741

742

# -- Ingress TLS configuration

743

tls: []

744

# - secretName: argoworkflows-example-tls

745

# hosts:

746

# - argoworkflows.example.com

747

## Create a Google Backendconfig for use with the GKE Ingress Controller

748

## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters

749

GKEbackendConfig:

750

# -- Enable BackendConfig custom resource for Google Kubernetes Engine

751

enabled: false

752

# -- [BackendConfigSpec]

753

spec: {}

754

# spec:

755

# iap:

756

# enabled: true

757

# oauthclientCredentials:

758

# secretName: argoworkflows-secret

759

760

## Create a Google Managed Certificate for use with the GKE Ingress Controller

761

## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

762

GKEmanagedCertificate:

763

# -- Enable ManagedCertificate custom resource for Google Kubernetes Engine.

764

enabled: false

765

# -- Domains for the Google Managed Certificate

766

domains:

767

- argoworkflows.example.com

768

## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller

769

## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

770

GKEfrontendConfig:

771

# -- Enable FrontConfig custom resource for Google Kubernetes Engine

772

enabled: false

773

# -- [FrontendConfigSpec]

774

spec: {}

775

# spec:

776

# redirectToHttps:

777

# enabled: true

778

# responseCodeName: RESPONSE_CODE

779

780

# Gateway API HTTPRoute configuration

781

# NOTE: Gateway API support is in EXPERIMENTAL status

782

# Support depends on your Gateway controller implementation

783

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

784

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

785

httproute:

786

# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)

787

enabled: false

788

# -- Additional HTTPRoute labels

789

labels: {}

790

# -- Additional HTTPRoute annotations

791

annotations: {}

792

# -- Gateway API parentRefs for the HTTPRoute

793

## Must reference an existing Gateway

794

# @default -- `[]` (See [values.yaml])

795

parentRefs: []

796

# - name: example-gateway

797

# namespace: example-gateway-namespace

798

# sectionName: https

799

# -- List of hostnames for the HTTPRoute

800

# @default -- `[]` (See [values.yaml])

801

hostnames: []

802

# - argoworkflows.example.com

803

# -- HTTPRoute rules configuration

804

# @default -- `[]` (See [values.yaml])

805

rules:

806

- matches:

807

- path:

808

type: PathPrefix

809

value: /

810

# filters: []

811

# - type: RequestHeaderModifier

812

# requestHeaderModifier:

813

# add:

814

# - name: X-Custom-Header

815

# value: custom-value

816

# timeouts:

817

# request: 10s

818

# backendRequest: 2s

819

# Gateway API BackendTLSPolicy configuration

820

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

821

# Required for HTTPS backends when using Gateway API

822

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

823

backendTLSPolicy:

824

# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)

825

enabled: false

826

# -- Additional BackendTLSPolicy labels

827

labels: {}

828

# -- Additional BackendTLSPolicy annotations

829

annotations: {}

830

# -- Target references for the BackendTLSPolicy

831

# @default -- `[]` (See [values.yaml])

832

targetRefs: []

833

# - group: ""

834

# kind: Service

835

# name: argo-workflows-server

836

# sectionName: https

837

# -- TLS validation configuration

838

# @default -- `{}` (See [values.yaml])

839

validation: {}

840

# hostname: argo-workflows-server.argo.svc.cluster.local

841

# caCertificateRefs:

842

# - name: example-ca-cert

843

# group: ""

844

# kind: ConfigMap

845

# wellKnownCACertificates: System

846

clusterWorkflowTemplates:

847

# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.

848

enabled: true

849

# -- Give the server permissions to edit ClusterWorkflowTemplates.

850

enableEditing: true

851

# SSO configuration when SSO is specified as a server auth mode.

852

sso:

853

# -- Create SSO configuration. If you set `true` , please also set `.Values.server.authModes` as `sso`.

854

enabled: false

855

# -- The root URL of the OIDC identity provider

856

issuer: https://accounts.google.com

857

clientId:

858

# -- Name of secret to retrieve the app OIDC client ID

859

860

# -- Key of secret to retrieve the app OIDC client ID

861

key: client-id

862

clientSecret:

863

# -- Name of a secret to retrieve the app OIDC client secret

864

865

# -- Key of a secret to retrieve the app OIDC client secret

866

key: client-secret

867

# -- The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.

868

redirectUrl: ""

869

rbac:

870

# -- Adds ServiceAccount Policy to server (Cluster)Role.

871

enabled: true

872

# -- Whitelist to allow server to fetch Secrets

873

## When present, restricts secrets the server can read to a given list.

874

## You can use it to restrict the server to only be able to access the

875

## service account token secrets that are associated with service accounts

876

## used for authorization.

877

secretWhitelist: []

878

# -- Scopes requested from the SSO ID provider

879

## The 'groups' scope requests group membership information, which is usually used for authorization decisions.

880

scopes: []

881

# - groups

882

# -- Define how long your login is valid for (in hours)

883

## If omitted, defaults to 10h.

884

sessionExpiry: ""

885

# -- Alternate root URLs that can be included for some OIDC providers

886

issuerAlias: ""

887

# -- Override claim name for OIDC groups

888

customGroupClaimName: ""

889

# -- Specify the user info endpoint that contains the groups claim

890

## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta)

891

userInfoPath: ""

892

# -- Skip TLS verification for the HTTP client

893

insecureSkipVerify: false

894

# -- Custom PEM encoded CA certificate file contents used to validate the OIDC provider's certificate

895

rootCA: ""

896

# -- Filter the groups returned by the OIDC provider

897

## A logical "OR" is used between each regex in the list

898

filterGroupsRegex: []

899

# - ".*argo-wf.*"

900

# - ".*argo-workflow.*"

901

# -- Extra containers to be added to the server deployment

902

extraContainers: []

903

# -- Enables init containers to be added to the server deployment

904

extraInitContainers: []

905

# -- Specify postStart and preStop lifecycle hooks for server container

906

lifecycle: {}

907

# -- terminationGracePeriodSeconds for container lifecycle hook

908

terminationGracePeriodSeconds: 30

909

## livenessProbe for server

910

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

911

livenessProbe:

912

# -- Enable Kubernetes liveness probe for server

913

enabled: false

914

httpGet:

915

# -- Http port to use for the liveness probe

916

port: 2746

917

# -- Http path to use for the liveness probe

918

path: /

919

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

920

failureThreshold: 3

921

# -- Number of seconds after the container has started before [probe] is initiated

922

initialDelaySeconds: 10

923

# -- How often (in seconds) to perform the [probe]

924

periodSeconds: 10

925

# -- Number of seconds after which the [probe] times out

926

timeoutSeconds: 1

927

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

928

successThreshold: 1

929

# -- Array of extra K8s manifests to deploy

930

extraObjects: []

931

# - apiVersion: secrets-store.csi.x-k8s.io/v1

932

# kind: SecretProviderClass

933

# metadata:

934

# name: argo-server-sso

935

# spec:

936

# provider: aws

937

# parameters:

938

# objects: |

939

# - objectName: "argo/server/sso"

940

# objectType: "secretsmanager"

941

# jmesPath:

942

# - path: "client_id"

943

# objectAlias: "client_id"

944

# - path: "client_secret"

945

# objectAlias: "client_secret"

946

# secretObjects:

947

# - data:

948

# - key: client_id

949

# objectName: client_id

950

# - key: client_secret

951

# objectName: client_secret

952

# secretName: argo-server-sso-secrets-store

953

# type: Opaque

954

955

# -- Use static credentials for S3 (eg. when not using AWS IRSA)

956

useStaticCredentials: true

957

artifactRepository:

958

# -- Archive the main container logs as an artifact

959

archiveLogs: false

960

# -- Store artifact in a S3-compliant object store

961

# @default -- See [values.yaml]

962

s3: {}

963

# # Note the `key` attribute is not the actual secret, it's the PATH to

964

# # the contents in the associated secret, as defined by the `name` attribute.

965

# accessKeySecret:

966

# name: "{{ .Release.Name }}-minio"

967

# key: accesskey

968

# secretKeySecret:

969

# name: "{{ .Release.Name }}-minio"

970

# key: secretkey

971

# sessionTokenSecret:

972

# name: "{{ .Release.Name }}-minio"

973

# key: sessionToken

974

# # insecure will disable TLS. Primarily used for minio installs not configured with TLS

975

# insecure: false

976

# caSecret:

977

# name: ca-root

978

# key: cert.pem

979

# bucket:

980

# endpoint:

981

# region:

982

# roleARN:

983

# useSDKCreds: true

984

# # addressingStyle must be one of: "" (auto-detect), path, virtual-hosted

985

# # Only valid for 4.1+

986

# addressingStyle: ""

987

# encryptionOptions:

988

# enableEncryption: true

989

# -- Store artifact in a GCS object store

990

# @default -- `{}` (See [values.yaml])

991

gcs: {}

992

# bucket: <project>-argo

993

# keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}"

994

# # serviceAccountKeySecret is a secret selector.

995

# # It references the k8s secret named 'my-gcs-credentials'.

996

# # This secret is expected to have the key 'serviceAccountKey',

997

# # containing the base64 encoded credentials

998

# # to the bucket.

999

# #

1000

# # If it's running on GKE and Workload Identity is used,

1001

# # serviceAccountKeySecret is not needed.

1002

# serviceAccountKeySecret:

1003

# name: my-gcs-credentials

1004

# key: serviceAccountKey

1005

# -- Store artifact in Azure Blob Storage

1006

# @default -- `{}` (See [values.yaml])

1007

azure: {}

1008

# endpoint: https://mystorageaccountname.blob.core.windows.net

1009

# container: my-container-name

1010

# blobNameFormat: path/in/container

1011

# # accountKeySecret is a secret selector.

1012

# # It references the k8s secret named 'my-azure-storage-credentials'.

1013

# # This secret is expected to have the key 'account-access-key',

1014

# # containing the base64 encoded credentials to the storage account.

1015

# # If a managed identity has been assigned to the machines running the

1016

# # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)

1017

# # then accountKeySecret is not needed, and useSDKCreds should be

1018

# # set to true instead:

1019

# useSDKCreds: true

1020

# accountKeySecret:

1021

# name: my-azure-storage-credentials

1022

# key: account-access-key

1023

# -- The section of custom artifact repository.

1024

# Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure)

1025

customArtifactRepository: {}

1026

# artifactory:

1027

# repoUrl: https://artifactory.example.com/raw

1028

# usernameSecret:

1029

# name: artifactory-creds

1030

# key: username

1031

# passwordSecret:

1032

# name: artifactory-creds

1033

# key: password

1034

1035

# -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/).

1036

# Each map key is the name of configmap

1037

# @default -- `{}` (See [values.yaml])

1038

artifactRepositoryRef: {}

1039

# # -- 1st ConfigMap

1040

# # If you want to use this config map by default, name it "artifact-repositories".

1041

# # Otherwise, you can provide a reference to a

1042

# # different config map in `artifactRepositoryRef.configMap`.

1043

# artifact-repositories:

1044

# # -- v3.0 and after - if you want to use a specific key, put that key into this annotation.

1045

# annotations:

1046

# workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository

1047

# # 1st data of configmap. See above artifactRepository or customArtifactRepository.

1048

# default-v1-s3-artifact-repository:

1049

# archiveLogs: false

1050

# s3:

1051

# bucket: my-bucket

1052

# endpoint: minio:9000

1053

# insecure: true

1054

# accessKeySecret:

1055

# name: my-minio-cred

1056

# key: accesskey

1057

# secretKeySecret:

1058

# name: my-minio-cred

1059

# key: secretkey

1060

# # 2nd data

1061

# oss-artifact-repository:

1062

# archiveLogs: false

1063

# oss:

1064

# endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com

1065

# bucket: $mybucket

1066

# # accessKeySecret and secretKeySecret are secret selectors.

1067

# # It references the k8s secret named 'bucket-workflow-artifect-credentials'.

1068

# # This secret is expected to have the keys 'accessKey'

1069

# # and 'secretKey', containing the base64 encoded credentials

1070

# # to the bucket.

1071

# accessKeySecret:

1072

# name: $mybucket-credentials

1073

# key: accessKey

1074

# secretKeySecret:

1075

# name: $mybucket-credentials

1076

# key: secretKey

1077

# # 2nd ConfigMap

1078

# another-artifact-repositories:

1079

# annotations:

1080

# workflows.argoproj.io/default-artifact-repository: gcs

1081

# gcs:

1082

# bucket: my-bucket

1083

# keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}}

1084

# serviceAccountKeySecret:

1085

# name: my-gcs-credentials

1086

# key: serviceAccountKey

1087

1088

emissary:

1089

# -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used.

1090

## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary

1091

images: []

1092

# argoproj/argosay:v2:

1093

# cmd: [/argosay]

1094

# docker/whalesay:latest:

1095

# cmd: [/bin/bash]

1096

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-workflows

The trusted source for open source

Product

Solutions

Customers

Resources

Company