argo-workflows
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
images:
2
# -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`.
3
tag: ""
4
# -- imagePullPolicy to apply to all containers
5
pullPolicy: Always
6
# -- Secrets with credentials to pull images from a private registry
7
pullSecrets: []
8
# - name: argo-pull-secret
9
## Custom resource configuration
10
crds:
11
# -- Install and upgrade CRDs
12
install: true
13
# -- Keep CRDs on chart uninstall
14
keep: true
15
# -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
16
# Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
17
full: true
18
# -- Annotations to be added to all CRDs (only applies when crds.full=false)
19
annotations: {}
20
# Configuration for the CRD install Job (only used when crds.full=true)
21
upgradeJob:
22
# -- Image for the kubectl container that applies CRDs
23
image:
24
# -- Repository for the kubectl image
25
repository: cgr.dev/chainguard-private/kubectl
26
# -- Tag for the kubectl image
27
tag: latest@sha256:813723b36eec34794fee5918af46e48ff25f09f46124afdc80acdc5ea4ff6a84
28
# -- Override base URL to download full CRD YAML files from. Defaults to this chart's release tag on GitHub. Ignored if hostPath is set.
29
crdBaseURL: ""
30
# -- Host path to mount CRD files from (for local/CI testing). When set, CRDs are applied from this path instead of downloading.
31
hostPath: ""
32
# -- Resources for the CRD install Job containers
33
resources: {}
34
# -- Node selector for the CRD install Job
35
nodeSelector: {}
36
# -- Pod security context for the CRD install Job pod
37
podSecurityContext: {}
38
# -- Optional labels to add to the CRD install Job pod
39
podLabels: {}
40
# -- Tolerations for the CRD install Job
41
tolerations: []
42
# -- Image pull secrets for the CRD install Job
43
imagePullSecrets: []
44
# -- Security context for the CRD install Job container
45
securityContext:
46
readOnlyRootFilesystem: true
47
runAsNonRoot: true
48
allowPrivilegeEscalation: false
49
runAsUser: 65532
50
runAsGroup: 65532
51
seccompProfile:
52
type: RuntimeDefault
53
capabilities:
54
drop:
55
- ALL
56
# -- Extra environment variables to provide to the CRD install Job container
57
extraEnv: []
58
# - name: HTTP_PROXY
59
# value: "http://proxy.example.com:8080"
60
# - name: HTTPS_PROXY
61
# value: "http://proxy.example.com:8080"
62
# - name: NO_PROXY
63
# value: "localhost,127.0.0.1,10.96.0.0/12,192.168.0.0/16"
64
# -- Create ClusterRoles that extend existing ClusterRoles to interact with Argo Workflows CRDs.
65
## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
66
createAggregateRoles: true
67
# -- String to partially override "argo-workflows.fullname" template
68
nameOverride:
69
# -- String to fully override "argo-workflows.fullname" template
70
fullnameOverride:
71
# -- Override the namespace
72
# @default -- `.Release.Namespace`
73
namespaceOverride: ""
74
# -- Labels to set on all resources
75
commonLabels: {}
76
# -- Override the Kubernetes version, which is used to evaluate certain manifests
77
kubeVersionOverride: ""
78
# Override APIVersions
79
apiVersionOverrides:
80
# -- String to override apiVersion of autoscaling rendered by this helm chart
81
autoscaling: "" # autoscaling/v2
82
# -- String to override apiVersion of GKE resources rendered by this helm chart
83
cloudgoogle: "" # cloud.google.com/v1
84
# -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart
85
monitoring: "" # monitoring.coreos.com/v1
86
# -- Restrict Argo to operate only in a single namespace (the namespace of the
87
# Helm release) by apply Roles and RoleBindings instead of the Cluster
88
# equivalents, and start workflow-controller with the --namespaced flag. Use it
89
# in clusters with strict access policy.
90
singleNamespace: false
91
workflow:
92
# -- Deprecated; use controller.workflowNamespaces instead.
93
namespace:
94
serviceAccount:
95
# -- Specifies whether a service account should be created
96
create: false
97
# -- Specifies whether a secret for each service account should be created
98
createSecret: false
99
# -- Labels applied to created service account
100
labels: {}
101
# -- Annotations applied to created service account
102
annotations: {}
103
# -- Service account which is used to run workflows
104
name: "argo-workflow"
105
# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`
106
pullSecrets: []
107
rbac:
108
# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.
109
# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)
110
create: true
111
# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates
112
agentPermissions: false
113
# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc
114
artifactGC: false
115
# -- Extra service accounts to be added to the RoleBinding
116
serviceAccounts: []
117
# - name: my-service-account
118
# namespace: my-namespace
119
# -- Additional rules for the service account that runs the workflows.
120
rules: []
121
controller:
122
image:
123
# -- Registry to use for the controller
124
registry: cgr.dev
125
# -- Registry to use for the controller
126
repository: chainguard-private/argo-workflowcontroller
127
# -- Image tag for the workflow controller. Defaults to `.Values.images.tag`.
128
tag: latest@sha256:726a165ebadfed320a22b96a066b69a556cdf02978a25aab6270f5e5799f8ff1
129
# -- parallelism dictates how many workflows can be running at the same time
130
parallelism:
131
# -- Globally limits the rate at which pods are created.
132
# This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of
133
# parallel nodes.
134
resourceRateLimit: {}
135
# limit: 10
136
# burst: 1
137
138
rbac:
139
# -- Adds Role and RoleBinding for the controller.
140
create: true
141
# -- Allows controller to get, list, and watch certain k8s secrets
142
secretWhitelist: []
143
# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.
144
accessAllSecrets: false
145
# -- Allows controller to create and update ConfigMaps. Enables memoization feature
146
writeConfigMaps: false
147
configMap:
148
# -- Create a ConfigMap for the controller
149
create: true
150
# -- ConfigMap name
151
name: ""
152
# -- ConfigMap annotations
153
annotations: {}
154
# -- Limits the maximum number of incomplete workflows in a namespace
155
namespaceParallelism:
156
# -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224
157
initialDelay:
158
# -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment
159
deploymentAnnotations: {}
160
# -- podAnnotations is an optional map of annotations to be applied to the controller Pods
161
podAnnotations: {}
162
# -- Optional labels to add to the controller pods
163
podLabels: {}
164
# -- SecurityContext to set on the controller pods
165
podSecurityContext: {}
166
# podPortName: http
167
metricsConfig:
168
# -- Enables prometheus metrics server
169
enabled: false
170
# -- Path is the path where metrics are emitted. Must start with a "/".
171
path: /metrics
172
# -- Frequency at which prometheus scrapes metrics
173
interval: 30s
174
# -- Port is the port where metrics are emitted
175
port: 9090
176
# -- How often custom metrics are cleared from memory
177
metricsTTL: ""
178
# -- Flag that instructs prometheus to ignore metric emission errors.
179
ignoreErrors: false
180
# -- Flag that use a self-signed cert for TLS
181
secure: false
182
# -- Container metrics port name
183
portName: metrics
184
# -- Service metrics port
185
servicePort: 8080
186
# -- Service metrics port name
187
servicePortName: metrics
188
# -- serviceMonitor scheme
189
scheme: http
190
# -- Flag to enable headless service
191
headlessService: false
192
# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.
193
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#honorlabels
194
honorLabels: false
195
# -- ServiceMonitor relabel configs to apply to samples before scraping
196
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
197
relabelings: []
198
# -- ServiceMonitor metric relabel configs to apply to samples before ingestion
199
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint
200
metricRelabelings: []
201
# -- ServiceMonitor will add labels from the service to the Prometheus metric
202
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec
203
targetLabels: []
204
# -- Manipulate the metrics created by the workflow controller
205
## Ref: https://argo-workflows.readthedocs.io/en/latest/metrics/#modifiers
206
modifiers: {}
207
# -- the controller container's securityContext
208
securityContext:
209
readOnlyRootFilesystem: true
210
runAsNonRoot: true
211
allowPrivilegeEscalation: false
212
capabilities:
213
drop:
214
- ALL
215
# -- enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available.
216
## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/
217
persistence: {}
218
# connectionPool:
219
# maxIdleConns: 100
220
# maxOpenConns: 0
221
# # save the entire workflow into etcd and DB
222
# nodeStatusOffLoad: false
223
# # enable archiving of old workflows
224
# archive: false
225
# postgresql:
226
# host: localhost
227
# port: 5432
228
# database: postgres
229
# tableName: argo_workflows
230
# # the database secrets must be in the same namespace of the controller
231
# userNameSecret:
232
# name: argo-postgres-config
233
# key: username
234
# passwordSecret:
235
# name: argo-postgres-config
236
# key: password
237
# ssl: true
238
# # sslMode must be one of: disable, require, verify-ca, verify-full
239
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
240
# sslMode: require
241
# mysql:
242
# host: localhost
243
# port: 3306
244
# database: argo
245
# tableName: argo_workflows
246
# userNameSecret:
247
# name: argo-mysql-config
248
# key: username
249
# passwordSecret:
250
# name: argo-mysql-config
251
# key: password
252
253
# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.
254
# Only valid for 2.7+
255
## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/
256
workflowDefaults: {}
257
# spec:
258
# ttlStrategy:
259
# secondsAfterCompletion: 86400
260
# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/
261
# artifactRepositoryRef:
262
# configMap: my-artifact-repository # default is "artifact-repositories"
263
# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.
264
265
# -- Number of workflow workers
266
workflowWorkers: # 32
267
# -- Number of workflow TTL workers
268
workflowTTLWorkers: # 4
269
# -- Number of pod cleanup workers
270
podCleanupWorkers: # 4
271
# -- Number of cron workflow workers
272
# Only valid for 3.5+
273
cronWorkflowWorkers: # 8
274
# -- Restricts the Workflows that the controller will process.
275
# Only valid for 2.9+
276
workflowRestrictions: {}
277
# templateReferencing: Strict|Secure
278
279
# telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint
280
# as metrics by default, but can be overridden using this config.
281
telemetryConfig:
282
# -- Enables prometheus telemetry server
283
enabled: false
284
# -- telemetry path
285
path: /telemetry
286
# -- Frequency at which prometheus scrapes telemetry data
287
interval: 30s
288
# -- telemetry container port
289
port: 8081
290
# -- How often custom metrics are cleared from memory
291
metricsTTL: ""
292
# -- Flag that instructs prometheus to ignore metric emission errors.
293
ignoreErrors: false
294
# -- Flag that use a self-signed cert for TLS
295
secure: false
296
# -- telemetry service port
297
servicePort: 8081
298
# -- telemetry service port name
299
servicePortName: telemetry
300
# -- telemetry serviceMonitor scheme to use
301
scheme: http
302
serviceMonitor:
303
# -- Enable a prometheus ServiceMonitor
304
enabled: false
305
# -- Prometheus ServiceMonitor labels
306
additionalLabels: {}
307
# -- Prometheus ServiceMonitor namespace
308
namespace: "" # "monitoring"
309
serviceAccount:
310
# -- Create a service account for the controller
311
create: true
312
# -- Service account name
313
name: ""
314
# -- Labels applied to created service account
315
labels: {}
316
# -- Annotations applied to created service account
317
annotations: {}
318
# -- Workflow controller name string
319
name: workflow-controller
320
# -- Specify all namespaces where this workflow controller instance will manage
321
# workflows. This controls where the service account and RBAC resources will
322
# be created. Only valid when singleNamespace is false.
323
workflowNamespaces:
324
- default
325
instanceID:
326
# -- Configures the controller to filter workflow submissions
327
# to only those which have a matching instanceID attribute.
328
## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`
329
## or `instanceID.explicitID` must be defined.
330
enabled: false
331
# -- Use ReleaseName as instanceID
332
useReleaseName: false
333
# useReleaseName: true
334
335
# -- Use a custom instanceID
336
explicitID: ""
337
# explicitID: unique-argo-controller-identifier
338
logging:
339
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
340
level: info
341
# -- Set the glog logging level
342
globallevel: "0"
343
# -- Set the logging format (one of: `text`, `json`)
344
format: "text"
345
# -- Service type of the controller Service
346
serviceType: ClusterIP
347
# -- Annotations to be applied to the controller Service
348
serviceAnnotations: {}
349
# -- Optional labels to add to the controller Service
350
serviceLabels: {}
351
# -- The class of the load balancer implementation
352
loadBalancerClass: ""
353
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
354
loadBalancerSourceRanges: []
355
# -- Resource limits and requests for the controller
356
resources: {}
357
# -- Configure liveness [probe] for the controller
358
# @default -- See [values.yaml]
359
livenessProbe:
360
httpGet:
361
port: 6060
362
path: /healthz
363
failureThreshold: 3
364
initialDelaySeconds: 90
365
periodSeconds: 60
366
timeoutSeconds: 30
367
# -- Extra environment variables to provide to the controller container
368
extraEnv: []
369
# - name: FOO
370
# value: "bar"
371
372
# -- Extra arguments to be added to the controller
373
extraArgs: []
374
# -- Additional volume mounts to the controller main container
375
volumeMounts: []
376
# -- Additional volumes to the controller pod
377
volumes: []
378
# -- The number of controller pods to run
379
replicas: 1
380
# -- The number of revisions to keep.
381
revisionHistoryLimit: 10
382
pdb:
383
# -- Configure [Pod Disruption Budget] for the controller pods
384
enabled: false
385
# minAvailable: 1
386
# maxUnavailable: 1
387
# -- [Node selector]
388
nodeSelector:
389
kubernetes.io/os: linux
390
# -- [Tolerations] for use with node taints
391
tolerations: []
392
# -- Assign custom [affinity] rules
393
affinity: {}
394
# -- Assign custom [TopologySpreadConstraints] rules to the workflow controller
395
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
396
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
397
topologySpreadConstraints: []
398
# - maxSkew: 1
399
# topologyKey: topology.kubernetes.io/zone
400
# whenUnsatisfiable: DoNotSchedule
401
402
# -- Leverage a PriorityClass to ensure your pods survive resource shortages.
403
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
404
priorityClassName: ""
405
# -- Configure Argo Server to show custom [links]
406
## Ref: https://argo-workflows.readthedocs.io/en/stable/links/
407
links: []
408
# -- Configure Argo Server to show custom [columns]
409
## Ref: https://github.com/argoproj/argo-workflows/pull/10693
410
columns: []
411
# -- Set ui navigation bar background color
412
navColor: ""
413
clusterWorkflowTemplates:
414
# -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.
415
enabled: true
416
# -- Extra service accounts to be added to the ClusterRoleBinding
417
serviceAccounts: []
418
# - name: my-service-account
419
# namespace: my-namespace
420
# -- Extra containers to be added to the controller deployment
421
extraContainers: []
422
# -- Enables init containers to be added to the controller deployment
423
extraInitContainers: []
424
# -- Workflow retention by number of workflows
425
retentionPolicy: {}
426
# completed: 10
427
# failed: 3
428
# errored: 3
429
430
nodeEvents:
431
# -- Enable to emit events on node completion.
432
## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events:
433
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
434
enabled: true
435
workflowEvents:
436
# -- Enable to emit events on workflow status changes.
437
## This can take up a lot of space in k8s (typically etcd), resulting in errors when trying to create new events:
438
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
439
enabled: true
440
# -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads,
441
# or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret.
442
# @default -- `{}` (See [values.yaml])
443
kubeConfig: {}
444
# # name of the kubeconfig secret, may not be empty when kubeConfig specified
445
# secretName: kubeconfig-secret
446
# # key of the kubeconfig secret, may not be empty when kubeConfig specified
447
# secretKey: kubeconfig
448
# # mounting path of the kubeconfig secret, default to /kube/config
449
# mountPath: /kubeconfig/mount/path
450
# # volume name when mounting the secret, default to kubeconfig
451
# volumeName: kube-config-volume
452
453
# -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately.
454
# @default -- `30` seconds (Kubernetes default)
455
podGCGracePeriodSeconds:
456
# -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately.
457
# @default -- `5s` (Argo Workflows default)
458
podGCDeleteDelayDuration: ""
459
# -- enable Synchronization to use a database. Postgres and MySQL (>= 5.7.8) are available.
460
## Ref: https://argo-workflows.readthedocs.io/en/latest/workflow-controller-configmap/#syncconfig
461
synchronization: {}
462
# controllerName: argo-workflows
463
# connectionPool:
464
# maxIdleConns: 100
465
# maxOpenConns: 0
466
# postgresql:
467
# host: localhost
468
# port: 5432
469
# database: postgres
470
# tableName: argo_workflows
471
# # the database secrets must be in the same namespace of the controller
472
# userNameSecret:
473
# name: argo-postgres-config
474
# key: username
475
# passwordSecret:
476
# name: argo-postgres-config
477
# key: password
478
# ssl: true
479
# # sslMode must be one of: disable, require, verify-ca, verify-full
480
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
481
# sslMode: require
482
# mysql:
483
# host: localhost
484
# port: 3306
485
# database: argo
486
# tableName: argo_workflows
487
# userNameSecret:
488
# name: argo-mysql-config
489
# key: username
490
# passwordSecret:
491
# name: argo-mysql-config
492
# key: password
493
494
failedPodRestart:
495
# -- Enable to restart of pods that fail before entering Running state.
496
## This is useful for recovering from transient infrastructure issues like node eviction due to DiskPressure or MemoryPressure without requiring a retryStrategy on every template.
497
## ref: https://argo-workflows.readthedocs.io/en/latest/pod-restarts/
498
enabled: false
499
# -- Maximum number of automatic restarts per node before giving up.
500
maxRestarts: 3
501
# mainContainer adds default config for main container that could be overriden in workflows template
502
mainContainer:
503
# -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`.
504
imagePullPolicy: ""
505
# -- Resource limits and requests for the Workflow main container
506
resources: {}
507
# -- Adds environment variables for the Workflow main container
508
env: []
509
# -- Adds reference environment variables for the Workflow main container
510
envFrom: []
511
# -- sets security context for the Workflow main container
512
securityContext: {}
513
# executor controls how the init and wait container should be customized
514
executor:
515
image:
516
# -- Registry to use for the Workflow Executors
517
registry: cgr.dev
518
# -- Repository to use for the Workflow Executors
519
repository: chainguard-private/argo-exec
520
# -- Image tag for the workflow executor. Defaults to `.Values.images.tag`.
521
tag: latest@sha256:c932e2e04d37559f36831be1a5b1724abe9db541fd015df9358419e8eb10b5f5
522
# -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`.
523
pullPolicy: ""
524
# -- Resource limits and requests for the Workflow Executors
525
resources: {}
526
# -- Passes arguments to the executor processes
527
args: []
528
# -- Adds environment variables for the executor.
529
env: []
530
# -- sets security context for the executor container
531
securityContext: {}
532
server:
533
# -- Deploy the Argo Server
534
enabled: true
535
# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.
536
## only updates base url of resources on client side,
537
## it's expected that a proxy server rewrites the request URL and gets rid of this prefix
538
## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190
539
baseHref: /
540
image:
541
# -- Registry to use for the server
542
registry: cgr.dev
543
# -- Repository to use for the server
544
repository: chainguard-private/argo-cli
545
# -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.
546
tag: latest@sha256:81e2246d80e0bf0acbdf8d9c98b0385061a82c42bcf6251b2d20df799d8191c7
547
# -- optional map of annotations to be applied to the ui Deployment
548
deploymentAnnotations: {}
549
# -- optional map of annotations to be applied to the ui Pods
550
podAnnotations: {}
551
# -- Optional labels to add to the UI pods
552
podLabels: {}
553
# -- SecurityContext to set on the server pods
554
podSecurityContext: {}
555
rbac:
556
# -- Adds Role and RoleBinding for the server.
557
create: true
558
# -- Servers container-level security context
559
securityContext:
560
readOnlyRootFilesystem: false
561
runAsNonRoot: true
562
allowPrivilegeEscalation: false
563
capabilities:
564
drop:
565
- ALL
566
# -- Server name string
567
name: server
568
# -- Service type for server pods
569
serviceType: ClusterIP
570
# -- Service port for server
571
servicePort: 2746
572
# -- Service target port for server
573
serviceTargetPort: 2746
574
# -- Service node port
575
serviceNodePort: # 32746
576
# -- Service port name
577
servicePortName: "" # http
578
# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files
579
hostAliases: []
580
# - ip: 10.20.30.40
581
# hostnames:
582
# - git.myhostname
583
584
serviceAccount:
585
# -- Create a service account for the server
586
create: true
587
# -- Service account name
588
name: ""
589
# -- Labels applied to created service account
590
labels: {}
591
# -- Annotations applied to created service account
592
annotations: {}
593
# -- Annotations to be applied to the UI Service
594
serviceAnnotations: {}
595
# -- Optional labels to add to the UI Service
596
serviceLabels: {}
597
# -- The class of the load balancer implementation
598
loadBalancerClass: ""
599
# -- Static IP address to assign to loadBalancer service type `LoadBalancer`
600
loadBalancerIP: ""
601
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
602
loadBalancerSourceRanges: []
603
# -- Resource limits and requests for the server
604
resources: {}
605
# -- The number of server pods to run
606
replicas: 1
607
# -- The number of revisions to keep.
608
revisionHistoryLimit: 10
609
## Argo Server Horizontal Pod Autoscaler
610
autoscaling:
611
# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server
612
enabled: false
613
# -- Minimum number of replicas for the Argo Server [HPA]
614
minReplicas: 1
615
# -- Maximum number of replicas for the Argo Server [HPA]
616
maxReplicas: 5
617
# -- Average CPU utilization percentage for the Argo Server [HPA]
618
targetCPUUtilizationPercentage: 50
619
# -- Average memory utilization percentage for the Argo Server [HPA]
620
targetMemoryUtilizationPercentage: 50
621
# -- Configures the scaling behavior of the target in both Up and Down directions.
622
# This is only available on HPA apiVersion `autoscaling/v2beta2` and newer
623
behavior: {}
624
# scaleDown:
625
# stabilizationWindowSeconds: 300
626
# policies:
627
# - type: Pods
628
# value: 1
629
# periodSeconds: 180
630
# scaleUp:
631
# stabilizationWindowSeconds: 300
632
# policies:
633
# - type: Pods
634
# value: 2
635
pdb:
636
# -- Configure [Pod Disruption Budget] for the server pods
637
enabled: false
638
# minAvailable: 1
639
# maxUnavailable: 1
640
# -- [Node selector]
641
nodeSelector:
642
kubernetes.io/os: linux
643
# -- [Tolerations] for use with node taints
644
tolerations: []
645
# -- Assign custom [affinity] rules
646
affinity: {}
647
# -- Assign custom [TopologySpreadConstraints] rules to the argo server
648
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
649
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
650
topologySpreadConstraints: []
651
# - maxSkew: 1
652
# topologyKey: topology.kubernetes.io/zone
653
# whenUnsatisfiable: DoNotSchedule
654
655
# -- Leverage a PriorityClass to ensure your pods survive resource shortages
656
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
657
priorityClassName: ""
658
# -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs.
659
## See the following documentation for more details on secure mode:
660
## https://argo-workflows.readthedocs.io/en/stable/tls/
661
secure: false
662
# -- Extra environment variables to provide to the argo-server container
663
extraEnv: []
664
# - name: FOO
665
# value: "bar"
666
667
# -- Deprecated; use server.authModes instead.
668
authMode: ""
669
# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.
670
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/
671
authModes: []
672
# -- Extra arguments to provide to the Argo server binary.
673
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options
674
extraArgs: []
675
logging:
676
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
677
level: info
678
# -- Set the glog logging level
679
globallevel: "0"
680
# -- Set the logging format (one of: `text`, `json`)
681
format: "text"
682
# -- Volume to be mounted in Pods for temporary files.
683
tmpVolume:
684
emptyDir: {}
685
# -- Additional volume mounts to the server main container.
686
volumeMounts: []
687
# -- Additional volumes to the server pod.
688
volumes: []
689
## Ingress configuration.
690
# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
691
ingress:
692
# -- Enable an ingress resource
693
enabled: false
694
# -- Additional ingress annotations
695
annotations: {}
696
# -- Additional ingress labels
697
labels: {}
698
# -- Defines which ingress controller will implement the resource
699
ingressClassName: ""
700
# -- List of ingress hosts
701
## Hostnames must be provided if Ingress is enabled.
702
## Secrets must be manually created in the namespace
703
hosts: []
704
# - argoworkflows.example.com
705
706
# -- List of ingress paths
707
paths:
708
- /
709
# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`
710
pathType: Prefix
711
# -- Additional ingress paths
712
extraPaths: []
713
# - path: /*
714
# backend:
715
# serviceName: ssl-redirect
716
# servicePort: use-annotation
717
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
718
# - path: /*
719
# pathType: Prefix
720
# backend:
721
# service
722
# name: ssl-redirect
723
# port:
724
# name: use-annotation
725
726
# -- Ingress TLS configuration
727
tls: []
728
# - secretName: argoworkflows-example-tls
729
# hosts:
730
# - argoworkflows.example.com
731
## Create a Google Backendconfig for use with the GKE Ingress Controller
732
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
733
GKEbackendConfig:
734
# -- Enable BackendConfig custom resource for Google Kubernetes Engine
735
enabled: false
736
# -- [BackendConfigSpec]
737
spec: {}
738
# spec:
739
# iap:
740
# enabled: true
741
# oauthclientCredentials:
742
# secretName: argoworkflows-secret
743
744
## Create a Google Managed Certificate for use with the GKE Ingress Controller
745
## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
746
GKEmanagedCertificate:
747
# -- Enable ManagedCertificate custom resource for Google Kubernetes Engine.
748
enabled: false
749
# -- Domains for the Google Managed Certificate
750
domains:
751
- argoworkflows.example.com
752
## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller
753
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters
754
GKEfrontendConfig:
755
# -- Enable FrontConfig custom resource for Google Kubernetes Engine
756
enabled: false
757
# -- [FrontendConfigSpec]
758
spec: {}
759
# spec:
760
# redirectToHttps:
761
# enabled: true
762
# responseCodeName: RESPONSE_CODE
763
764
# Gateway API HTTPRoute configuration
765
# NOTE: Gateway API support is in EXPERIMENTAL status
766
# Support depends on your Gateway controller implementation
767
# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)
768
# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details
769
httproute:
770
# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)
771
enabled: false
772
# -- Additional HTTPRoute labels
773
labels: {}
774
# -- Additional HTTPRoute annotations
775
annotations: {}
776
# -- Gateway API parentRefs for the HTTPRoute
777
## Must reference an existing Gateway
778
# @default -- `[]` (See [values.yaml])
779
parentRefs: []
780
# - name: example-gateway
781
# namespace: example-gateway-namespace
782
# sectionName: https
783
# -- List of hostnames for the HTTPRoute
784
# @default -- `[]` (See [values.yaml])
785
hostnames: []
786
# - argoworkflows.example.com
787
# -- HTTPRoute rules configuration
788
# @default -- `[]` (See [values.yaml])
789
rules:
790
- matches:
791
- path:
792
type: PathPrefix
793
value: /
794
# filters: []
795
# - type: RequestHeaderModifier
796
# requestHeaderModifier:
797
# add:
798
# - name: X-Custom-Header
799
# value: custom-value
800
# timeouts:
801
# request: 10s
802
# backendRequest: 2s
803
# Gateway API BackendTLSPolicy configuration
804
# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status
805
# Required for HTTPS backends when using Gateway API
806
# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)
807
backendTLSPolicy:
808
# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)
809
enabled: false
810
# -- Additional BackendTLSPolicy labels
811
labels: {}
812
# -- Additional BackendTLSPolicy annotations
813
annotations: {}
814
# -- Target references for the BackendTLSPolicy
815
# @default -- `[]` (See [values.yaml])
816
targetRefs: []
817
# - group: ""
818
# kind: Service
819
# name: argo-workflows-server
820
# sectionName: https
821
# -- TLS validation configuration
822
# @default -- `{}` (See [values.yaml])
823
validation: {}
824
# hostname: argo-workflows-server.argo.svc.cluster.local
825
# caCertificateRefs:
826
# - name: example-ca-cert
827
# group: ""
828
# kind: ConfigMap
829
# wellKnownCACertificates: System
830
clusterWorkflowTemplates:
831
# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
832
enabled: true
833
# -- Give the server permissions to edit ClusterWorkflowTemplates.
834
enableEditing: true
835
# SSO configuration when SSO is specified as a server auth mode.
836
sso:
837
# -- Create SSO configuration. If you set `true` , please also set `.Values.server.authModes` as `sso`.
838
enabled: false
839
# -- The root URL of the OIDC identity provider
840
issuer: https://accounts.google.com
841
clientId:
842
# -- Name of secret to retrieve the app OIDC client ID
843
name: argo-server-sso
844
# -- Key of secret to retrieve the app OIDC client ID
845
key: client-id
846
clientSecret:
847
# -- Name of a secret to retrieve the app OIDC client secret
848
name: argo-server-sso
849
# -- Key of a secret to retrieve the app OIDC client secret
850
key: client-secret
851
# -- The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.
852
redirectUrl: ""
853
rbac:
854
# -- Adds ServiceAccount Policy to server (Cluster)Role.
855
enabled: true
856
# -- Whitelist to allow server to fetch Secrets
857
## When present, restricts secrets the server can read to a given list.
858
## You can use it to restrict the server to only be able to access the
859
## service account token secrets that are associated with service accounts
860
## used for authorization.
861
secretWhitelist: []
862
# -- Scopes requested from the SSO ID provider
863
## The 'groups' scope requests group membership information, which is usually used for authorization decisions.
864
scopes: []
865
# - groups
866
# -- Define how long your login is valid for (in hours)
867
## If omitted, defaults to 10h.
868
sessionExpiry: ""
869
# -- Alternate root URLs that can be included for some OIDC providers
870
issuerAlias: ""
871
# -- Override claim name for OIDC groups
872
customGroupClaimName: ""
873
# -- Specify the user info endpoint that contains the groups claim
874
## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta)
875
userInfoPath: ""
876
# -- Skip TLS verification for the HTTP client
877
insecureSkipVerify: false
878
# -- Filter the groups returned by the OIDC provider
879
## A logical "OR" is used between each regex in the list
880
filterGroupsRegex: []
881
# - ".*argo-wf.*"
882
# - ".*argo-workflow.*"
883
# -- Extra containers to be added to the server deployment
884
extraContainers: []
885
# -- Enables init containers to be added to the server deployment
886
extraInitContainers: []
887
# -- Specify postStart and preStop lifecycle hooks for server container
888
lifecycle: {}
889
# -- terminationGracePeriodSeconds for container lifecycle hook
890
terminationGracePeriodSeconds: 30
891
## livenessProbe for server
892
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
893
livenessProbe:
894
# -- Enable Kubernetes liveness probe for server
895
enabled: false
896
httpGet:
897
# -- Http port to use for the liveness probe
898
port: 2746
899
# -- Http path to use for the liveness probe
900
path: /
901
# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded
902
failureThreshold: 3
903
# -- Number of seconds after the container has started before [probe] is initiated
904
initialDelaySeconds: 10
905
# -- How often (in seconds) to perform the [probe]
906
periodSeconds: 10
907
# -- Number of seconds after which the [probe] times out
908
timeoutSeconds: 1
909
# -- Minimum consecutive successes for the [probe] to be considered successful after having failed
910
successThreshold: 1
911
# -- Array of extra K8s manifests to deploy
912
extraObjects: []
913
# - apiVersion: secrets-store.csi.x-k8s.io/v1
914
# kind: SecretProviderClass
915
# metadata:
916
# name: argo-server-sso
917
# spec:
918
# provider: aws
919
# parameters:
920
# objects: |
921
# - objectName: "argo/server/sso"
922
# objectType: "secretsmanager"
923
# jmesPath:
924
# - path: "client_id"
925
# objectAlias: "client_id"
926
# - path: "client_secret"
927
# objectAlias: "client_secret"
928
# secretObjects:
929
# - data:
930
# - key: client_id
931
# objectName: client_id
932
# - key: client_secret
933
# objectName: client_secret
934
# secretName: argo-server-sso-secrets-store
935
# type: Opaque
936
937
# -- Use static credentials for S3 (eg. when not using AWS IRSA)
938
useStaticCredentials: true
939
artifactRepository:
940
# -- Archive the main container logs as an artifact
941
archiveLogs: false
942
# -- Store artifact in a S3-compliant object store
943
# @default -- See [values.yaml]
944
s3: {}
945
# # Note the `key` attribute is not the actual secret, it's the PATH to
946
# # the contents in the associated secret, as defined by the `name` attribute.
947
# accessKeySecret:
948
# name: "{{ .Release.Name }}-minio"
949
# key: accesskey
950
# secretKeySecret:
951
# name: "{{ .Release.Name }}-minio"
952
# key: secretkey
953
# sessionTokenSecret:
954
# name: "{{ .Release.Name }}-minio"
955
# key: sessionToken
956
# # insecure will disable TLS. Primarily used for minio installs not configured with TLS
957
# insecure: false
958
# caSecret:
959
# name: ca-root
960
# key: cert.pem
961
# bucket:
962
# endpoint:
963
# region:
964
# roleARN:
965
# useSDKCreds: true
966
# encryptionOptions:
967
# enableEncryption: true
968
# -- Store artifact in a GCS object store
969
# @default -- `{}` (See [values.yaml])
970
gcs: {}
971
# bucket: <project>-argo
972
# keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}"
973
# # serviceAccountKeySecret is a secret selector.
974
# # It references the k8s secret named 'my-gcs-credentials'.
975
# # This secret is expected to have the key 'serviceAccountKey',
976
# # containing the base64 encoded credentials
977
# # to the bucket.
978
# #
979
# # If it's running on GKE and Workload Identity is used,
980
# # serviceAccountKeySecret is not needed.
981
# serviceAccountKeySecret:
982
# name: my-gcs-credentials
983
# key: serviceAccountKey
984
# -- Store artifact in Azure Blob Storage
985
# @default -- `{}` (See [values.yaml])
986
azure: {}
987
# endpoint: https://mystorageaccountname.blob.core.windows.net
988
# container: my-container-name
989
# blobNameFormat: path/in/container
990
# # accountKeySecret is a secret selector.
991
# # It references the k8s secret named 'my-azure-storage-credentials'.
992
# # This secret is expected to have the key 'account-access-key',
993
# # containing the base64 encoded credentials to the storage account.
994
# # If a managed identity has been assigned to the machines running the
995
# # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)
996
# # then accountKeySecret is not needed, and useSDKCreds should be
997
# # set to true instead:
998
# useSDKCreds: true
999
# accountKeySecret:
1000
# name: my-azure-storage-credentials
1001
# key: account-access-key
1002
# -- The section of custom artifact repository.
1003
# Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure)
1004
customArtifactRepository: {}
1005
# artifactory:
1006
# repoUrl: https://artifactory.example.com/raw
1007
# usernameSecret:
1008
# name: artifactory-creds
1009
# key: username
1010
# passwordSecret:
1011
# name: artifactory-creds
1012
# key: password
1013
1014
# -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/).
1015
# Each map key is the name of configmap
1016
# @default -- `{}` (See [values.yaml])
1017
artifactRepositoryRef: {}
1018
# # -- 1st ConfigMap
1019
# # If you want to use this config map by default, name it "artifact-repositories".
1020
# # Otherwise, you can provide a reference to a
1021
# # different config map in `artifactRepositoryRef.configMap`.
1022
# artifact-repositories:
1023
# # -- v3.0 and after - if you want to use a specific key, put that key into this annotation.
1024
# annotations:
1025
# workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository
1026
# # 1st data of configmap. See above artifactRepository or customArtifactRepository.
1027
# default-v1-s3-artifact-repository:
1028
# archiveLogs: false
1029
# s3:
1030
# bucket: my-bucket
1031
# endpoint: minio:9000
1032
# insecure: true
1033
# accessKeySecret:
1034
# name: my-minio-cred
1035
# key: accesskey
1036
# secretKeySecret:
1037
# name: my-minio-cred
1038
# key: secretkey
1039
# # 2nd data
1040
# oss-artifact-repository:
1041
# archiveLogs: false
1042
# oss:
1043
# endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com
1044
# bucket: $mybucket
1045
# # accessKeySecret and secretKeySecret are secret selectors.
1046
# # It references the k8s secret named 'bucket-workflow-artifect-credentials'.
1047
# # This secret is expected to have the keys 'accessKey'
1048
# # and 'secretKey', containing the base64 encoded credentials
1049
# # to the bucket.
1050
# accessKeySecret:
1051
# name: $mybucket-credentials
1052
# key: accessKey
1053
# secretKeySecret:
1054
# name: $mybucket-credentials
1055
# key: secretKey
1056
# # 2nd ConfigMap
1057
# another-artifact-repositories:
1058
# annotations:
1059
# workflows.argoproj.io/default-artifact-repository: gcs
1060
# gcs:
1061
# bucket: my-bucket
1062
# keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}}
1063
# serviceAccountKeySecret:
1064
# name: my-gcs-credentials
1065
# key: serviceAccountKey
1066
1067
emissary:
1068
# -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used.
1069
## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary
1070
images: []
1071
# argoproj/argosay:v2:
1072
# cmd: [/argosay]
1073
# docker/whalesay:latest:
1074
# cmd: [/bin/bash]
1075
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.