Executor can access the k8s apiserver with a out-of-cluster config file

[houz42]

Our production k8s cluster operators have banned accessing the k8s apiserver with an in-cluster strategy (using a service account). We have to configure the executor with a kube config file to access it in an out-of-cluster strategy. It may be helpful for other users.

[alexmt]

Hello @houz42 , thank you for contribution!

It is possible to manually mount kubeconfig from secret using spec.volumes field (see examples/volumes-existing.yaml).

I agree that it is useful to provide shortcut but it we would have to provide more settings to handle edge cases:

• volumeMount name should be customizable since pod already might has volumeMount named kube-config
• volume name should be customizable since workflow already might have volume names kube-config
• pod container user is not necessary root so mount path should be customizable .
• user might want to give k8s access to some workflows, not every workflow handled by controller.

I think it would be better to document this case or add an example workflow

[houz42]

@alexmt

It is possible to manually mount kubeconfig from secret using spec.volumes field

volumes configured in spec.volumes will be set to the main container, not the wait container. we need the wait container have access to the apiserver.

we would have to provide more settings to handle edge cases

You are right. I will make the volume name and path customizable.

I think it would be better to document this case or add an example workflow

And yes, I will add an example

[houz42]

@alexmt
Changes have been made for custom kubeconfig secret volume name & mount path, and controller config example.

But an irrelevent test always fails and blocks the ci. I proposed a fix in #1221 which should be accepted before this one.

[alexmt]

LGTM!