Passing k8s secret to a workflow as input #5506

roitalpaz · 2021-03-25T08:06:47Z

Summary

I know it is possible to pass a secret to a container via ENV or FILE. but it is not possible to pass it as an argument of a workflow.

Use Cases

I have a few tools which accept values as command line args. These args are values which I'm not convenient in putting in YAMLs as plaintext and would like to store as k8s secrets.

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

alexec · 2021-03-25T15:20:57Z

Could you propose the syntax? Where would the secrets be? In the user namespace? The controller would need RBAC access. Might not pass security audit for some users.

roitalpaz · 2021-03-29T08:15:10Z

Thanks for the quick comment!

Syntax

Regarding the syntax I though something along the lines:

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: arguments-parameters-
spec:
  entrypoint: whalesay
  arguments:
    parameters:
    - name: message
      valueFrom:
         secretKeyRef:
           name: my-secret
           key: mypassword


  templates:
  - name: whalesay
    inputs:
      parameters:
      - name: message
    container:
      image: docker/whalesay:latest
      command: [cowsay]
      args: ["{{inputs.parameters.message}}"]

The valueFrom idea is taken from here: https://argoproj.github.io/argo-workflows/examples/#secrets

Secrets location

regarding the location of the secrets, I think placing the secret in the user namespace and giving permissions to the controller to this specific secret only will pass most security audits.

using the resourceNames https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources

alexec · 2021-03-29T15:29:15Z

That looks good. Would you like to submit a PR?

shuheiktgw · 2021-07-23T06:46:21Z

Hi, may I work on this issue if no one does right now?

StepanKuksenko · 2021-10-17T15:34:04Z

@shuheiktgw hi, do you have any progress regarding this?

terrytangyuan · 2021-10-19T01:48:43Z

We've recently added support for loading parameters from ConfigMaps in #6662 so it should be pretty straightforward to support secret as well following that reference implementation.

alexec · 2021-10-19T14:42:55Z

If anyone would like to commit the changes, the core team will provide support.

shadiramadan · 2022-02-02T23:53:07Z

So for functionality is this basically a clone of ~~#6982~~ #6662 @alexec @terrytangyuan ?

Should we also sanitize the display of such parameters as 'secret' ?

Should you be able to mark a parameter as secret at all?

- name: my-pass
  value: "{{some-output-val}}"
  secret: "true"

Which could subsequently not display the raw value anywhere?
Same with outputs I guess... or is this overkill?

ArgoCD displays secrets like this:

I'm having an issue right now where I'm using the http template and I have an API key.
Right now it is passed in as a param but it renders in the UI. The alternative is to make a container running curl and pass it as an env value.... but I felt that was a little too much.

alexec · 2022-02-03T16:43:16Z

I think you mean it is a clone of #6662. I think it might be more difficult. I think we store parameters in the workflows status. But, we should not do this with secrets. I might be wrong. Could you investigate?

sarabala1979 · 2022-05-04T06:08:46Z

@roitalpaz you can mount the secret on pods. this is a more secure way to access the secret in container

panakour · 2022-05-21T13:58:05Z

any update on this?

jamesgoodhouse · 2022-08-17T05:10:49Z

I'm unsure the reason Argo can't load secrets like this, but I suspect it was an intentional decision to limit Argo from accessing secrets directly. I just load the secret name into my workflows and pass it down to the container that needs it, and have it be "responsible" for getting the value from the secret.

beejiujitsu · 2022-08-26T19:30:03Z

Related to OP:

When using Templates directly (e.g., the HTTP Template), it isn't possible to read a k8s secret into it.

jamesgoodhouse · 2022-08-26T19:31:54Z

why not just pass the secret name in and have the container load the secret? there's no need for argo to load the secret, nor do i think it should.

beejiujitsu · 2022-08-26T19:37:27Z

why not just pass the secret name in and have the container load the secret? there's no need for argo to load the secret, nor do i think it should.

The HTTP Template is a built-in template that doesn't offer container parameters, so what you're suggesting isn't possible.

https://argoproj.github.io/argo-workflows/http-template/

kevinpauli · 2022-08-31T04:31:50Z

I too am attempting to use http template, and would like to set the authorization header using a value from a secret.

beejiujitsu · 2022-08-31T18:28:45Z

I too am attempting to use http template, and would like to set the authorization header using a value from a secret.

I wrote this workflow to work-around the httpTemplate secrets limitation.

You're welcome to modify this WorkFlowTemplate to suit your needs.

---
 apiVersion: argoproj.io/v1alpha1
 kind: WorkflowTemplate
 metadata:
   annotations:
     workflows.argoproj.io/description: 'Forked subgraph: notify Discord'
     workflows.argoproj.io/maintainer: '@beejiujitsu'
     workflows.argoproj.io/version: '>= v3.3.6'
   name: forked-subgraph-notify-discord
 spec:
   activeDeadlineSeconds: 172800
   arguments:
     parameters:
       - name: content_prefix
       - name: forked_subgraph_name
       - name: forked_subgraph_url
   entrypoint: main
   podGC:
     strategy: OnWorkflowSuccess
   podMetadata:
     labels:
       app: forked-subgraph
   templates:
     - container:
         args:
           - $(WEBHOOK_URL)
           - '--include'
           - '--json'
           - '{"content": "{{inputs.parameters.content_prefix}} {{inputs.parameters.forked_subgraph_name}}: {{inputs.parameters.forked_subgraph_url}}"}'
         command:
           - curl
         env:
           - name: WEBHOOK_URL
             valueFrom:
               secretKeyRef:
                 key: forked-subgraph
                 name: discord-webhooks
         image: curlimages/curl:7.84.0
         name: curl
         resources:
           limits:
             memory: 100Mi
           requests:
             memory: 50Mi
         securityContext:
           allowPrivilegeEscalation: false
           runAsGroup: 1000
           runAsUser: 1000
       inputs:
         parameters:
           - name: content_prefix
           - name: forked_subgraph_name
           - name: forked_subgraph_url
       name: main

johnlinp · 2022-10-04T05:55:02Z

Hi, I created a workaround for the secret parameter: a template that extracts secret as a output parameter.

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: secret-extractor
spec:
  templates:
    - name: main
      inputs:
        parameters:
          - name: secretName
          - name: secretKey
      outputs:
        parameters:
          - name: secretValue
            valueFrom:
              path: /tmp/secret-value
      container:
        image: docker-registry.netbase.com/alpine:latest
        command:
          - sh
          - '-c'
        args:
          - echo -n "$SECRET_VALUE" > /tmp/secret-value
        env:
          - name: SECRET_VALUE
            valueFrom:
              secretKeyRef:
                name: "{{inputs.parameters.secretName}}"
                key: "{{inputs.parameters.secretKey}}"
  entrypoint: main

One can use it in steps, for example:

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: demo
spec:
  templates:
    - name: main
      steps:
        - - name: extract-secret
            templateRef:
              name: secret-extractor
              template: main
            arguments:
              parameters:
                - name: secretName
                  value: demo-secret
                - name: secretKey
                  value: password
        - - name: print-msg
            template: msg-printer
            arguments:
              parameters:
                - name: msg
                  value: "{{steps.extract-secret.outputs.parameters.secretValue}}"
    - name: msg-printer
      inputs:
        parameters:
          - name: msg
      container:
        image: docker-registry.netbase.com/alpine:latest
        command:
          - echo
          - "{{inputs.parameters.msg}}"
  entrypoint: main

Igor992 · 2022-10-17T08:41:54Z

@johnlinp Thanks for this, works perfectly! 👍🏼

tooptoop4 · 2023-02-13T06:25:02Z

i have similar issue with resources.requests....getting "Failed to parse workflow template: quantities must match the regular expression '^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$'" with:

        resources:
          requests:
            memory: "{{inputs.parameters.ram}}Gi"
            cpu: "{{inputs.parameters.cpu}}"

xmsanchez · 2023-04-27T08:03:05Z

@beejiujitsu suggested solution works perfectly and is the most efficient and secure from this thread IMO.

         args:
           - $(WEBHOOK_URL)
           - '--include'
           - '--json'
           - '{"content": "{{inputs.parameters.content_prefix}} {{inputs.parameters.forked_subgraph_name}}: {{inputs.parameters.forked_subgraph_url}}"}'
         env:
           - name: WEBHOOK_URL
             valueFrom:
               secretKeyRef:
                 key: forked-subgraph
                 name: discord-webhooks

joebowbeer · 2023-05-30T06:51:24Z

With support for resource action: get another workaround is:

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: secret-extractor
spec:
  entrypoint: main
  templates:
  - name: main
    inputs:
      parameters:
      - name: secretNamespace
        value: default
      - name: secretName
      - name: secretKey
    outputs:
      parameters:
      - name: secretValue
        valueFrom:
          jsonPath: '{.data.{{inputs.parameters.secretKey}}}'
    resource:
      action: get
      manifest: |
        apiVersion: v1
        kind: Secret
        metadata:
          name: {{inputs.parameters.secretName}}
          namespace: {{inputs.parameters.secretNamespace}}

umi0410 · 2023-07-23T06:11:53Z

@terrytangyuan I'm interested in this issue. Could I investigate this?

terrytangyuan · 2023-07-23T17:30:41Z

@umi0410 Sure go ahead

umi0410 · 2023-07-25T14:29:38Z

@terrytangyuan I wrote a PR for the initial implementation. Could you take a look at it?

artemklevtsov · 2023-12-12T03:57:28Z

You're welcome to modify this WorkFlowTemplate to suit your needs. [...]

But pass env to the args not works for me:

# yaml-language-server: $schema=https://raw.githubusercontent.com/argoproj/argo-workflows/master/api/jsonschema/schema.json
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: curl-test-
spec:
  entrypoint: main
  templates:
    - name: main
      container:
        image: quay.io/curl/curl:latest
        env:
          - name: URL
            value: https://ifconfig.co
        command:
          - curl
        args:
          - ${URL}

What am I doing wrong?

Work only with shell:

        command:
          - sh
        args:
          - -c
          - curl -s ${URL}

beejiujitsu · 2024-01-13T16:26:10Z

But pass env to the args not works for me: [...]

What am I doing wrong?

Work only with shell: [...]

You're using curly braces for the arg env var; use parentheses. See my example again.

rossigee · 2024-08-18T04:59:31Z

Security issues aside, the workarounds so far all depend on containers and shell substitution, so aren't very efficient.

It would be great to be able to pull a secret into an HTTP template without needing an intermediate container step. For example, pull a variable 'discord_url' in and use it as the 'url' for a POST request.

Signed-off-by: shuangkun <[email protected]>

roitalpaz added the type/feature Feature request label Mar 25, 2021

alexec added the help wanted label Oct 19, 2021

alexec added area/spec Changes to the workflow specification. and removed help wanted labels Feb 7, 2022

alexec added the good first issue Good for newcomers label Apr 11, 2022

sarabala1979 added the hacktoberfest label Oct 11, 2022

This comment was marked as duplicate.

Sign in to view

terrytangyuan mentioned this issue Jul 24, 2023

Introduce support for a new password parameter type with masking #11431

Open

umi0410 mentioned this issue Jul 25, 2023

[Draft] feat: support Secrets as a type of parameter #11446

Closed

agilgur5 added solution/workaround There's a workaround, might not be great, but exists solution/suggested A solution to the bug has been suggested. Someone needs to implement it. and removed good first issue Good for newcomers hacktoberfest labels Feb 12, 2024

agilgur5 added the type/security Security related label Apr 4, 2024

agilgur5 removed the solution/suggested A solution to the bug has been suggested. Someone needs to implement it. label Aug 4, 2024

shuangkun added a commit to shuangkun/argo-workflows that referenced this issue Nov 12, 2024

feat: pass secret to workflow as input. Fixes:argoproj#5506

142143d

Signed-off-by: shuangkun <[email protected]>

shuangkun linked a pull request Nov 14, 2024 that will close this issue

feat: Support loading parameter values from secrets. Fixes: #5506 #13899

Open

shuangkun added a commit to shuangkun/argo-workflows that referenced this issue Nov 14, 2024

feat: pass secret to workflow as input. Fixes:argoproj#5506

052325a

Signed-off-by: shuangkun <[email protected]>

shuangkun added a commit to shuangkun/argo-workflows that referenced this issue Jan 5, 2025

feat: pass secret to workflow as input. Fixes:argoproj#5506

e51e021

Signed-off-by: shuangkun <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Passing k8s secret to a workflow as input #5506

Passing k8s secret to a workflow as input #5506

roitalpaz commented Mar 25, 2021

alexec commented Mar 25, 2021

roitalpaz commented Mar 29, 2021 •

edited by agilgur5

Loading

alexec commented Mar 29, 2021

shuheiktgw commented Jul 23, 2021

StepanKuksenko commented Oct 17, 2021

terrytangyuan commented Oct 19, 2021 •

edited

Loading

alexec commented Oct 19, 2021

shadiramadan commented Feb 2, 2022 •

edited by agilgur5

Loading

alexec commented Feb 3, 2022

sarabala1979 commented May 4, 2022

panakour commented May 21, 2022

jamesgoodhouse commented Aug 17, 2022

beejiujitsu commented Aug 26, 2022

jamesgoodhouse commented Aug 26, 2022

beejiujitsu commented Aug 26, 2022

kevinpauli commented Aug 31, 2022

beejiujitsu commented Aug 31, 2022 •

edited by agilgur5

Loading

johnlinp commented Oct 4, 2022

Igor992 commented Oct 17, 2022

This comment was marked as duplicate.

tooptoop4 commented Feb 13, 2023 •

edited by agilgur5

Loading

xmsanchez commented Apr 27, 2023 •

edited by agilgur5

Loading

joebowbeer commented May 30, 2023

umi0410 commented Jul 23, 2023 •

edited

Loading

terrytangyuan commented Jul 23, 2023

umi0410 commented Jul 25, 2023

artemklevtsov commented Dec 12, 2023 •

edited by agilgur5

Loading

beejiujitsu commented Jan 13, 2024 •

edited by agilgur5

Loading

rossigee commented Aug 18, 2024

Passing k8s secret to a workflow as input #5506

Passing k8s secret to a workflow as input #5506

Comments

roitalpaz commented Mar 25, 2021

Summary

Use Cases

alexec commented Mar 25, 2021

roitalpaz commented Mar 29, 2021 • edited by agilgur5 Loading

Syntax

Secrets location

alexec commented Mar 29, 2021

shuheiktgw commented Jul 23, 2021

StepanKuksenko commented Oct 17, 2021

terrytangyuan commented Oct 19, 2021 • edited Loading

alexec commented Oct 19, 2021

shadiramadan commented Feb 2, 2022 • edited by agilgur5 Loading

alexec commented Feb 3, 2022

sarabala1979 commented May 4, 2022

panakour commented May 21, 2022

jamesgoodhouse commented Aug 17, 2022

beejiujitsu commented Aug 26, 2022

jamesgoodhouse commented Aug 26, 2022

beejiujitsu commented Aug 26, 2022

kevinpauli commented Aug 31, 2022

beejiujitsu commented Aug 31, 2022 • edited by agilgur5 Loading

johnlinp commented Oct 4, 2022

Igor992 commented Oct 17, 2022

This comment was marked as duplicate.

tooptoop4 commented Feb 13, 2023 • edited by agilgur5 Loading

xmsanchez commented Apr 27, 2023 • edited by agilgur5 Loading

joebowbeer commented May 30, 2023

umi0410 commented Jul 23, 2023 • edited Loading

terrytangyuan commented Jul 23, 2023

umi0410 commented Jul 25, 2023

artemklevtsov commented Dec 12, 2023 • edited by agilgur5 Loading

beejiujitsu commented Jan 13, 2024 • edited by agilgur5 Loading

rossigee commented Aug 18, 2024

roitalpaz commented Mar 29, 2021 •

edited by agilgur5

Loading

terrytangyuan commented Oct 19, 2021 •

edited

Loading

shadiramadan commented Feb 2, 2022 •

edited by agilgur5

Loading

beejiujitsu commented Aug 31, 2022 •

edited by agilgur5

Loading

tooptoop4 commented Feb 13, 2023 •

edited by agilgur5

Loading

xmsanchez commented Apr 27, 2023 •

edited by agilgur5

Loading

umi0410 commented Jul 23, 2023 •

edited

Loading

artemklevtsov commented Dec 12, 2023 •

edited by agilgur5

Loading

beejiujitsu commented Jan 13, 2024 •

edited by agilgur5

Loading