argoproj / argoproj/argo-workflows
Add Flag to override TLS certificate location
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 138
Description
# Summary
A command flag in [server.go](https://github.com/argoproj/argo-workflows/blob/e566c106bbe9baf8ab3628a80235467bb867b57e/cmd/argo/commands/server.go#L185) that would allow the user to set a custom location in the pod filesystem (e.g. `/tls/tls.crt` / `/tls/tls.key`) that the server looks to for a TLS certificate .
# Use Cases
This would allow users to mount their own certificates (e.g. from vault / k8s secret), and also allow for external controllers (like cert-manager) to manage the certificates rotation.
Restricted environments/organisations also may require Fully validated TLS Encryption from a trusted Root CA.
# Notes
Another thing to note is that it seems as though the [makefile](https://github.com/argoproj/argo-workflows/blob/3db467e6b9bed209404c1a8a0152468ea832f06d/Makefile#L190) generates a single set of key/cert each time the image is built.
My concern is that this means (especially if TLS is now [default](https://github.com/argoproj/argo-workflows/pull/5686)) the certificate will become invalid 365 days after the image was built, and the image itself will no longer function correctly, with no way of easily mounting your own certificate to replace it.
## I would like to make my first contribution!
As I have a good idea about how this enhancement can be delivered, I would like the opportunity to create the PR myself and complete my first contribution. Therefore if I could have this issue assigned to me I would very much appreciate it 😃
---
**Message from the maintainers**:
Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.
Contributor guide
Research direction
Start with cmd/argo/commands/server.go at the flag and server setup referenced in the issue, then inspect the Makefile certificate generation noted in the body. Trace how the server selects its TLS certificate and determine the expected behavior for custom certificate and key paths. Done means the flag supports mounted certificates without changing the existing default behavior, with relevant server tests updated or added.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- cli, infrastructure, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100