Como enviar um workflow para um namespace específico? - Container Service for Kubernetes: Central de Documentação do Alibaba Cloud

Por padrão, o Argo Workflows envia todos os workflows para o namespace argo. Para executar workflows em um namespace separado e garantir isolamento de recursos e permissões, configure o Role-Based Access Control (RBAC) no namespace de destino e envie o workflow com a flag -n.

Caso de uso comum: se uma equipe executa pipelines de CI/CD e outra executa jobs de processamento de dados, atribua um namespace próprio a cada equipe em vez de compartilhar o namespace argo.

Pré-requisitos

Antes de começar, verifique se você tem:

kubectl instalado e configurado com acesso ao cluster ACK
CLI do Argo (argo) instalada

Conceda permissões RBAC a um namespace

Passo 1: Crie o namespace de destino

kubectl create ns test

Passo 2: Crie o arquivo de autorização

Crie um arquivo chamado role-rolebinding.yaml com o conteúdo a seguir. Ele define cinco Roles e quatro RoleBindings, todos vinculados à service account default.

Aviso

A service account default é compartilhada. Outras workloads podem adicionar permissões não intencionais a ela. Para workloads de produção, crie uma service account dedicada aos seus workflows em vez de usar a default.

Se a sua versão do Argo Workflows for v3.2 ou anterior, substitua workflowtasksets/status por patch workflowtasksets nas regras da Role agent.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    workflows.argoproj.io/description: |
      This is the minimum recommended permissions needed if you want to use the agent, e.g. for HTTP or plugin templates.

      If <= v3.2 you must replace `workflowtasksets/status` with `patch workflowtasksets`.
  name: agent
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtasksets
    verbs:
      - list
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtasksets/status
    verbs:
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    workflows.argoproj.io/description: |
      This is the minimum recommended permissions needed if you want to use artifact GC.
  name: artifactgc
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workflowartifactgctasks
    verbs:
        - list
        - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflowartifactgctasks/status
    verbs:
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    workflows.argoproj.io/description: |
      Recommended minimum permissions for the `emissary` executor.
  name: executor
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtaskresults
    verbs:
      - create
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: submit-workflow-template
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workfloweventbindings
    verbs:
      - list
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtemplates
    verbs:
      - get
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    workflows.argoproj.io/description: |
      This is an example of the permissions you would need if you wanted to use a resource template to create and manage
      other workflows. The same pattern would be suitable for other resurces, e.g. a service
  name: workflow-manager
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
    verbs:
      - create
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: agent-default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: agent
subjects:
  - kind: ServiceAccount
    name: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: artifactgc-default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: artifactgc
subjects:
  - kind: ServiceAccount
    name: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: executor-default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: executor
subjects:
  - kind: ServiceAccount
    name: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: workflow-manager-default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: workflow-manager
subjects:
  - kind: ServiceAccount
    name: default

Passo 3: Aplique a autorização

kubectl apply -f role-rolebinding.yaml -n test

Saída esperada:

role.rbac.authorization.k8s.io/agent created
role.rbac.authorization.k8s.io/artifactgc created
role.rbac.authorization.k8s.io/executor created
role.rbac.authorization.k8s.io/submit-workflow-template created
role.rbac.authorization.k8s.io/workflow-manager created
rolebinding.rbac.authorization.k8s.io/agent-default created
rolebinding.rbac.authorization.k8s.io/artifactgc-default created
rolebinding.rbac.authorization.k8s.io/executor-default created
rolebinding.rbac.authorization.k8s.io/workflow-manager-default created

Envie um workflow para o namespace

Passo 4: Crie o arquivo do workflow

Crie um arquivo chamado helloworld-workflow.yaml:

apiVersion: argoproj.io/v1alpha1
kind: Workflow                # Defines a new Kubernetes resource type for Argo Workflows.
metadata:
  generateName: hello-world-  # The prefix for the workflow name. Kubernetes will append a unique suffix.
spec:
  entrypoint: main            # Specifies the template to execute first.
  templates:
    - name: main              # The name of the template.
      container:
        image: mirrors-ssl.aliyuncs.com/busybox:latest
        command: [ echo ]
        args: [ "hello world" ]

Passo 5: Envie o workflow

Envie o workflow para o namespace test:

argo submit helloworld-workflow.yaml -n test