argoproj / argoproj/argo-workflows

WorkflowArchive support rotating DB passwords

Open
#7,575 2 comments 2 reactions 0 assignees View on GitHub
area/workflow-archive type/security
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 20h
Merged PRs (30d)
138

Description

# Summary

For security reasons we have a rotating DB password - this means our DB password changes every day.
In the source code, I could see the WorkflowArchive in initiated with a password on the server initialization.
This means, we need to restart the service on every password change.
A better solution would involve having the Argo WorkflowArchive retrieve the db password secret before the use of the DB connection or having an API for restarting the DB session

# Use Cases

On every DB password change

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

Contributor guide

Open the contributing guide

Research direction

Start by locating WorkflowArchive initialization and its database connection lifecycle; the issue does not name files or tests. Determine how the rotating database secret can be used without restarting the service, and define validation showing that a password change is handled during normal operation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
backend, databases, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.