feat: support custom CA with s3 repository. Fixes #10560 #11161
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This PR will not build correctly without the argoproj/pkg changes in place. I'll update Any feedback is more than welcome! |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
|
Can you rebase and update argoproj/pkg? |
Signed-off-by: Niklas Simons <niklas.simons@est.tech>
nsimons
requested review from
jessesuen,
alexec,
terrytangyuan and
sarabala1979
as code owners
terrytangyuan
approved these changes
Aug 16, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #10560
Motivation
Similarly to the linked issue, we are securing a local s3 repository with an internal CA and would need to get the TLS chain verification working.
Modifications
This PR introduces a new SecretKeySelector parameter to the artifact configuration,
caSecret. This secret is automatically mounted to the workflow pod, then theinitandwait(executor) containers are configuring their respective s3 clients to use this secret in the TLS connection with the s3 repository.Documentation added to
docs/configure-artifact-repository.mdDepends on a change in argoproj/pkg. We need to allow the caller to set/access HTTP Transport -related functionality in the s3 client. PR: argoproj/pkg#417
Verification
I didn't find a good place to put automatic tests, but I've been verifying with the following setup: https://gist.github.com/nsimons/d0b688dd99f15283af0136515a4aa149
Then running some sample workflows involving artifacts.