Archive Logs for Workflows in different Namespaces

[yanehi]

I ran into a problem configuring the archive-logs for individual workflows.

My ConfigMap, as well as the associated secret for the archive-logs are in the argo-workflows namespace. However, when I start a workflow in a different namespace, I naturally get the following error:

level=warning msg="Non-transient error: configmaps \"artifact-repositories\" not found"

I don't want to create the ConfigMap for the archive-bucket configuration in each namespace. Is there a way to pass the bucket configuration from the ConfigMap in the argo-workflows namespace to each starting pod (also in other namespaces) via the workflow-controller?

For the secret I can just create a ClusterSecret in case of doubt.

[agilgur5]

You can set artifact configuration globally via the Workflow Controller ConfigMap: https://argoproj.github.io/argo-workflows/workflow-controller-configmap/

[yanehi]

Thank you, the global config in the argo-workflows configmap fixed my error. Iam now possible to save my logs from workflow pods running in different namespace.

However, I have now encountered another problem. The workflow pods absolutely need the "patch pods" permission, otherwise the logs cannot be saved.

I was able to reproduce the problem and the logs are really only saved once he has this permission.

Is there a particular reason for this? I don't want to give my workflow pod such extensive permissions in the namespace just to archive logs.

[agilgur5]

If you're on version 3.4+, you can avoid that by giving workflowtaskresults permissions instead. See https://argoproj.github.io/argo-workflows/workflow-rbac/.
The logs should mention that pod patch is a fallback.

That is the minimum RBAC needed for the executor in general, not specific to archive logs.

[yanehi]

Nice, thank you very much! This fixed my problem to write the logs without patch/pod permissions!