argoproj / argoproj/argo-workflows

Add Flag to override TLS certificate location

Open
#6,355 12 comments 13 reactions 0 assignees View on GitHub
area/server type/security
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 15h
Merged PRs (30d)
138

Description

# Summary

A command flag in [server.go](https://github.com/argoproj/argo-workflows/blob/e566c106bbe9baf8ab3628a80235467bb867b57e/cmd/argo/commands/server.go#L185) that would allow the user to set a custom location in the pod filesystem (e.g. `/tls/tls.crt` / `/tls/tls.key`) that the server looks to for a TLS certificate .

# Use Cases

This would allow users to mount their own certificates (e.g. from vault / k8s secret), and also allow for external controllers (like cert-manager) to manage the certificates rotation.

Restricted environments/organisations also may require Fully validated TLS Encryption from a trusted Root CA.

# Notes

Another thing to note is that it seems as though the [makefile](https://github.com/argoproj/argo-workflows/blob/3db467e6b9bed209404c1a8a0152468ea832f06d/Makefile#L190) generates a single set of key/cert each time the image is built.

My concern is that this means (especially if TLS is now [default](https://github.com/argoproj/argo-workflows/pull/5686)) the certificate will become invalid 365 days after the image was built, and the image itself will no longer function correctly, with no way of easily mounting your own certificate to replace it.

## I would like to make my first contribution!

As I have a good idea about how this enhancement can be delivered, I would like the opportunity to create the PR myself and complete my first contribution. Therefore if I could have this issue assigned to me I would very much appreciate it 😃

---

**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Contributor guide

Open the contributing guide

Research direction

Start with cmd/argo/commands/server.go at the flag and server setup referenced in the issue, then inspect the Makefile certificate generation noted in the body. Trace how the server selects its TLS certificate and determine the expected behavior for custom certificate and key paths. Done means the flag supports mounted certificates without changing the existing default behavior, with relevant server tests updated or added.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cli, infrastructure, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.