Skip to content

fix(cli): pass namespace to archived workflow get - #16823

Open
gpomykala wants to merge 1 commit into
argoproj:mainfrom
gpomykala:fix/archive-get-namespace-delegation
Open

fix(cli): pass namespace to archived workflow get#16823
gpomykala wants to merge 1 commit into
argoproj:mainfrom
gpomykala:fix/archive-get-namespace-delegation

Conversation

@gpomykala

@gpomykala gpomykala commented Aug 26, 2026

Copy link
Copy Markdown

See the pull request guide for details on each item.

  • Ran make pre-commit -B
  • Signed-off commits with Conventional Commit messages
  • PR title is a conventional commit message (it becomes the release notes entry)
  • Unit or e2e tests cover the change
  • For features: not applicable; this is a bug fix
  • Opened as draft; builds are green and this is ready for review

Fixes #16822

Motivation

argo archive get WORKFLOW --namespace NAMESPACE did not include the namespace in the final GetArchivedWorkflowRequest. With SSO RBAC namespace delegation enabled, Argo Server could not select the namespace service account and instead evaluated the request using the login service account, resulting in PermissionDenied.

The request type already includes a namespace field, and the command already resolves the namespace for name-to-UID lookup. The namespace was only dropped from the final direct GET.

Modifications

  • Pass the resolved CLI namespace in GetArchivedWorkflowRequest.
  • Add a unit regression test that verifies both the UID and namespace sent to the archived workflow client.
  • Exercise explicit --namespace arguments for UID- and name-based archive GETs in the existing CLI E2E suite.

Verification

Passed:

make pre-commit -B
go test -count=1 ./cmd/argo/commands/archive ./server/auth ./server/workflowarchive
go test -run '^$' -tags cli ./test/e2e
git diff --check

A manual A/B regression test reproduced the failure with the released CLI and confirmed that the CLI built from this branch returns the archived workflow when an explicit namespace is supplied.

Documentation

No documentation change is needed. This restores the existing --namespace flag behavior for archive get and does not introduce a new user-facing option.

AI

OpenAI Codex assisted with investigating the request path, implementing the fix, adding tests, and preparing this PR description. I reviewed and validated the resulting changes, including a manual A/B regression test.

Backport

This is a small, backward-compatible bug fix using an existing request field. Please consider adding the cherry-pick/4.1 and cherry-pick/4.0 labels.

Summary by CodeRabbit

  • Bug Fixes

    • Fixed archived workflow retrieval to correctly respect the specified namespace.
    • Improved archive retrieval by UID and name when using the namespace option.
  • Tests

    • Added coverage to verify namespace-aware archived workflow retrieval.

Signed-off-by: Grzegorz Pomykala <gpomykala@splunk.com>
@gpomykala
gpomykala marked this pull request as ready for review August 26, 2026 15:38
@gpomykala
gpomykala requested a review from a team as a code owner August 26, 2026 15:38
@coderabbitai

coderabbitai Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ce7e070-c2ac-41bf-a9ad-537aa575b7b1

📥 Commits

Reviewing files that changed from the base of the PR and between 8f0d280 and ef8e714.

📒 Files selected for processing (3)
  • cmd/argo/commands/archive/get.go
  • cmd/argo/commands/archive/get_test.go
  • test/e2e/cli_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.


📝 Walkthrough

Walkthrough

The archive get command now passes the selected namespace to archived workflow retrieval. Unit and end-to-end tests verify namespace handling for UID-based and name-based retrieval.

Changes

Archive get namespace handling

Layer / File(s) Summary
Namespace-aware archived workflow retrieval
cmd/argo/commands/archive/get.go
The command uses getArchivedWorkflow to request an archived workflow with both the resolved UID and selected namespace.
Retrieval regression coverage
cmd/argo/commands/archive/get_test.go, test/e2e/cli_test.go
Unit tests verify the request fields and returned workflow. End-to-end tests pass --namespace argo for UID-based and name-based retrieval.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to ef8e7

This restores namespace propagation for archived workflow retrieval without changing the public interface; the change is localized and covered by regression tests, so no actionable merge-blocking risk remains.

Suggested reviewers: joibel

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the primary change: passing the namespace to archived workflow retrieval.
Description check ✅ Passed The description follows the repository template and documents motivation, modifications, verification, documentation impact, AI usage, and backport guidance.
Linked Issues check ✅ Passed The implementation satisfies issue #16822 by propagating the resolved namespace in GetArchivedWorkflowRequest and adding UID, namespace, and CLI regression coverage.
Out of Scope Changes check ✅ Passed All changes are directly related to the namespace propagation fix and its unit and end-to-end regression tests. No unrelated code changes are identified.
  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Joibel Joibel left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neither unit nor e2e test fails without the code change, so they don't guard it.

Please could you apply the same fix to Delete whilst you're in here, it's also missing the namespace passthrough.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

argo archive get ignores --namespace, breaking SSO RBAC namespace delegation

2 participants