Skip to content

Commit 9fa1639

Browse files
lexfreiclaude
lexfrei
and
claude
committed
feat(argo-workflows): Add Gateway API HTTPRoute support
Add support for Gateway API HTTPRoute and BackendTLSPolicy resources as an alternative to traditional Kubernetes Ingress for Argo Workflows server. Changes: - Add server-httproute.yaml template for Gateway API v1 HTTPRoute - Add server-backendtlspolicy.yaml template for v1alpha3 BackendTLSPolicy - Add httproute and backendTLSPolicy configuration sections to values.yaml - Add documentation for Gateway API usage in README.md.gotmpl - Bump chart version to 0.46.0 Key differences from Argo CD implementation: - No GRPCRoute support (Argo Workflows uses HTTP/HTTPS only, not gRPC) - Simplified port logic (single service port) All features are disabled by default for backward compatibility. Gateway API support is marked as EXPERIMENTAL. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
1 parent d22a459 commit 9fa1639

File tree

6 files changed

+259
-3
lines changed

6 files changed

+259
-3
lines changed

‎charts/argo-workflows/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ appVersion: v3.7.3
33
name: argo-workflows
44
description: A Helm chart for Argo Workflows
55
type: application
6-
version: 0.45.27
6+
version: 0.46.0
77
icon: https://argo-workflows.readthedocs.io/en/stable/assets/logo.png
88
home: https://github.com/argoproj/argo-helm
99
sources:
@@ -16,5 +16,5 @@ annotations:
1616
fingerprint: 2B8F22F57260EFA67BE1C5824B11F800CD9D2252
1717
url: https://argoproj.github.io/argo-helm/pgp_keys.asc
1818
artifacthub.io/changes: |
19-
- kind: changed
20-
description: Bump argo-workflows to v3.7.3
19+
- kind: added
20+
description: Add Gateway API HTTPRoute support for Argo Workflows server

‎charts/argo-workflows/README.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,61 @@ Please refer to [Argo Server Auth Mode] for more details.
9191

9292
Argo Workflows server also supports SSO and you can enable it to configure `.Values.server.sso` and `.Values.server.authModes`. In order to manage access levels, you can optionally add RBAC to SSO. Please refer to [SSO RBAC] for more details.
9393

94+
### Ingress Configuration
95+
96+
Argo Workflows server can be exposed using Kubernetes Ingress or Gateway API HTTPRoute.
97+
98+
#### Traditional Kubernetes Ingress
99+
100+
See the `server.ingress` section in values.yaml for standard Ingress configuration.
101+
102+
#### Gateway API HTTPRoute
103+
104+
The Gateway API provides a modern, extensible way to configure ingress traffic routing. This chart supports HTTPRoute resources as an alternative to traditional Ingress.
105+
106+
> **Note:**
107+
> Gateway API support is **EXPERIMENTAL**. Support depends on your Gateway controller implementation. Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends). Refer to [Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) for controller-specific details.
108+
109+
```yaml
110+
server:
111+
httproute:
112+
enabled: true
113+
parentRefs:
114+
- name: example-gateway
115+
namespace: gateway-system
116+
sectionName: https
117+
hostnames:
118+
- argoworkflows.example.com
119+
```
120+
121+
##### Gateway API with TLS backend
122+
123+
For HTTPS backends with Gateway API (when `server.secure: true`), you may need to configure BackendTLSPolicy (experimental, v1alpha3):
124+
125+
> **Warning:**
126+
> BackendTLSPolicy is in **EXPERIMENTAL** status. Not all Gateway controllers support this resource (e.g., Cilium does not yet support it).
127+
128+
```yaml
129+
server:
130+
secure: true
131+
132+
httproute:
133+
enabled: true
134+
parentRefs:
135+
- name: example-gateway
136+
namespace: gateway-system
137+
138+
backendTLSPolicy:
139+
enabled: true
140+
targetRefs:
141+
- group: ""
142+
kind: Service
143+
name: argo-workflows-server
144+
validation:
145+
hostname: argo-workflows-server.argo.svc.cluster.local
146+
wellKnownCACertificates: System
147+
```
148+
94149
## Values
95150

96151
The `values.yaml` contains items used to tweak a deployment of this chart.
@@ -291,6 +346,11 @@ Fields to note:
291346
| server.autoscaling.minReplicas | int | `1` | Minimum number of replicas for the Argo Server [HPA] |
292347
| server.autoscaling.targetCPUUtilizationPercentage | int | `50` | Average CPU utilization percentage for the Argo Server [HPA] |
293348
| server.autoscaling.targetMemoryUtilizationPercentage | int | `50` | Average memory utilization percentage for the Argo Server [HPA] |
349+
| server.backendTLSPolicy.annotations | object | `{}` | Additional BackendTLSPolicy annotations |
350+
| server.backendTLSPolicy.enabled | bool | `false` | Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API) |
351+
| server.backendTLSPolicy.labels | object | `{}` | Additional BackendTLSPolicy labels |
352+
| server.backendTLSPolicy.targetRefs | list | `[]` (See [values.yaml]) | Target references for the BackendTLSPolicy |
353+
| server.backendTLSPolicy.validation | object | `{}` (See [values.yaml]) | TLS validation configuration |
294354
| server.baseHref | string | `"/"` | Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /. |
295355
| server.clusterWorkflowTemplates.enableEditing | bool | `true` | Give the server permissions to edit ClusterWorkflowTemplates. |
296356
| server.clusterWorkflowTemplates.enabled | bool | `true` | Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates. |
@@ -301,6 +361,12 @@ Fields to note:
301361
| server.extraEnv | list | `[]` | Extra environment variables to provide to the argo-server container |
302362
| server.extraInitContainers | list | `[]` | Enables init containers to be added to the server deployment |
303363
| server.hostAliases | list | `[]` | Mapping between IP and hostnames that will be injected as entries in the pod's hosts files |
364+
| server.httproute.annotations | object | `{}` | Additional HTTPRoute annotations |
365+
| server.httproute.enabled | bool | `false` | Enable HTTPRoute resource for Argo Workflows server (Gateway API) |
366+
| server.httproute.hostnames | list | `[]` (See [values.yaml]) | List of hostnames for the HTTPRoute |
367+
| server.httproute.labels | object | `{}` | Additional HTTPRoute labels |
368+
| server.httproute.parentRefs | list | `[]` (See [values.yaml]) | Gateway API parentRefs for the HTTPRoute |
369+
| server.httproute.rules | list | `[]` (See [values.yaml]) | HTTPRoute rules configuration |
304370
| server.image.registry | string | `"quay.io"` | Registry to use for the server |
305371
| server.image.repository | string | `"argoproj/argocli"` | Repository to use for the server |
306372
| server.image.tag | string | `""` | Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`. |

‎charts/argo-workflows/README.md.gotmpl‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,61 @@ Please refer to [Argo Server Auth Mode] for more details.
9191

9292
Argo Workflows server also supports SSO and you can enable it to configure `.Values.server.sso` and `.Values.server.authModes`. In order to manage access levels, you can optionally add RBAC to SSO. Please refer to [SSO RBAC] for more details.
9393

94+
### Ingress Configuration
95+
96+
Argo Workflows server can be exposed using Kubernetes Ingress or Gateway API HTTPRoute.
97+
98+
#### Traditional Kubernetes Ingress
99+
100+
See the `server.ingress` section in values.yaml for standard Ingress configuration.
101+
102+
#### Gateway API HTTPRoute
103+
104+
The Gateway API provides a modern, extensible way to configure ingress traffic routing. This chart supports HTTPRoute resources as an alternative to traditional Ingress.
105+
106+
> **Note:**
107+
> Gateway API support is **EXPERIMENTAL**. Support depends on your Gateway controller implementation. Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends). Refer to [Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) for controller-specific details.
108+
109+
```yaml
110+
server:
111+
httproute:
112+
enabled: true
113+
parentRefs:
114+
- name: example-gateway
115+
namespace: gateway-system
116+
sectionName: https
117+
hostnames:
118+
- argoworkflows.example.com
119+
```
120+
121+
##### Gateway API with TLS backend
122+
123+
For HTTPS backends with Gateway API (when `server.secure: true`), you may need to configure BackendTLSPolicy (experimental, v1alpha3):
124+
125+
> **Warning:**
126+
> BackendTLSPolicy is in **EXPERIMENTAL** status. Not all Gateway controllers support this resource (e.g., Cilium does not yet support it).
127+
128+
```yaml
129+
server:
130+
secure: true
131+
132+
httproute:
133+
enabled: true
134+
parentRefs:
135+
- name: example-gateway
136+
namespace: gateway-system
137+
138+
backendTLSPolicy:
139+
enabled: true
140+
targetRefs:
141+
- group: ""
142+
kind: Service
143+
name: argo-workflows-server
144+
validation:
145+
hostname: argo-workflows-server.argo.svc.cluster.local
146+
wellKnownCACertificates: System
147+
```
148+
94149

95150
## Values
96151

‎charts/argo-workflows/templates/server/server-backendtlspolicy.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{- if and .Values.server.enabled .Values.server.backendTLSPolicy.enabled -}}
2+
{{- $fullName := include "argo-workflows.server.fullname" . -}}
3+
apiVersion: gateway.networking.k8s.io/v1alpha3
4+
kind: BackendTLSPolicy
5+
metadata:
6+
name: {{ $fullName }}
7+
namespace: {{ include "argo-workflows.namespace" . | quote }}
8+
labels:
9+
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
10+
{{- with .Values.server.backendTLSPolicy.labels }}
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
{{- with .Values.server.backendTLSPolicy.annotations }}
14+
annotations:
15+
{{- toYaml . | nindent 4 }}
16+
{{- end }}
17+
spec:
18+
targetRefs:
19+
{{- with .Values.server.backendTLSPolicy.targetRefs }}
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- with .Values.server.backendTLSPolicy.validation }}
23+
validation:
24+
{{- toYaml . | nindent 4 }}
25+
{{- end }}
26+
{{- end }}

‎charts/argo-workflows/templates/server/server-httproute.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{{- if and .Values.server.enabled .Values.server.httproute.enabled -}}
2+
{{- $fullName := include "argo-workflows.server.fullname" . -}}
3+
{{- $servicePort := .Values.server.servicePort -}}
4+
apiVersion: gateway.networking.k8s.io/v1
5+
kind: HTTPRoute
6+
metadata:
7+
name: {{ $fullName }}
8+
namespace: {{ include "argo-workflows.namespace" . | quote }}
9+
labels:
10+
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
11+
{{- with .Values.server.httproute.labels }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
14+
{{- with .Values.server.httproute.annotations }}
15+
annotations:
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
parentRefs:
20+
{{- with .Values.server.httproute.parentRefs }}
21+
{{- toYaml . | nindent 4 }}
22+
{{- end }}
23+
{{- with .Values.server.httproute.hostnames }}
24+
hostnames:
25+
{{- toYaml . | nindent 4 }}
26+
{{- end }}
27+
rules:
28+
{{- range .Values.server.httproute.rules }}
29+
{{- with .matches }}
30+
- matches:
31+
{{- toYaml . | nindent 8 }}
32+
{{- end }}
33+
{{- with .filters }}
34+
filters:
35+
{{- toYaml . | nindent 8 }}
36+
{{- end }}
37+
backendRefs:
38+
- group: ''
39+
kind: Service
40+
name: {{ $fullName }}
41+
port: {{ $servicePort }}
42+
weight: 1
43+
{{- end }}
44+
{{- end }}

‎charts/argo-workflows/values.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -752,6 +752,71 @@ server:
752752
# enabled: true
753753
# responseCodeName: RESPONSE_CODE
754754

755+
# Gateway API HTTPRoute configuration
756+
# NOTE: Gateway API support is in EXPERIMENTAL status
757+
# Support depends on your Gateway controller implementation
758+
# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)
759+
# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details
760+
httproute:
761+
# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)
762+
enabled: false
763+
# -- Additional HTTPRoute labels
764+
labels: {}
765+
# -- Additional HTTPRoute annotations
766+
annotations: {}
767+
# -- Gateway API parentRefs for the HTTPRoute
768+
## Must reference an existing Gateway
769+
# @default -- `[]` (See [values.yaml])
770+
parentRefs: []
771+
# - name: example-gateway
772+
# namespace: example-gateway-namespace
773+
# sectionName: https
774+
# -- List of hostnames for the HTTPRoute
775+
# @default -- `[]` (See [values.yaml])
776+
hostnames: []
777+
# - argoworkflows.example.com
778+
# -- HTTPRoute rules configuration
779+
# @default -- `[]` (See [values.yaml])
780+
rules:
781+
- matches:
782+
- path:
783+
type: PathPrefix
784+
value: /
785+
# filters: []
786+
# - type: RequestHeaderModifier
787+
# requestHeaderModifier:
788+
# add:
789+
# - name: X-Custom-Header
790+
# value: custom-value
791+
792+
# Gateway API BackendTLSPolicy configuration
793+
# NOTE: BackendTLSPolicy is in EXPERIMENTAL status (v1alpha3)
794+
# Required for HTTPS backends when using Gateway API
795+
# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)
796+
backendTLSPolicy:
797+
# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)
798+
enabled: false
799+
# -- Additional BackendTLSPolicy labels
800+
labels: {}
801+
# -- Additional BackendTLSPolicy annotations
802+
annotations: {}
803+
# -- Target references for the BackendTLSPolicy
804+
# @default -- `[]` (See [values.yaml])
805+
targetRefs: []
806+
# - group: ""
807+
# kind: Service
808+
# name: argo-workflows-server
809+
# sectionName: https
810+
# -- TLS validation configuration
811+
# @default -- `{}` (See [values.yaml])
812+
validation: {}
813+
# hostname: argo-workflows-server.argo.svc.cluster.local
814+
# caCertificateRefs:
815+
# - name: example-ca-cert
816+
# group: ""
817+
# kind: ConfigMap
818+
# wellKnownCACertificates: System
819+
755820
clusterWorkflowTemplates:
756821
# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
757822
enabled: true

0 commit comments

Comments
 (0)