Argo工作流--无法获得令牌卷:服务帐户argo/default没有任何秘密

Question

我是Argo新手，遵循Quickstart模板，希望将HTTP模板部署为工作流。

我创建的集群如下：

minikube start --driver=docker --cpus='2' --memory='8g'
kubectl create ns argo
kubectl apply -n argo -f https://raw.githubusercontent.com/argoproj/argo-workflows/master/manifests/quick-start-postgres.yaml

然后，我从文档中应用HTTP模板http_template.yaml：

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: http-template-
spec:
  entrypoint: main
  templates:
    - name: main
      steps:
        - - name: get-google-homepage
            template: http
            arguments:
              parameters: [ { name: url, value: "https://www.google.com" } ]
    - name: http
      inputs:
        parameters:
          - name: url
      http:
        timeoutSeconds: 20 # Default 30
        url: "{{inputs.parameters.url}}"
        method: "GET" # Default GET
        headers:
          - name: "x-header-name"
            value: "test-value"
        # Template will succeed if evaluated to true, otherwise will fail
        # Available variables:
        #  request.body: string, the request body
        #  request.headers: map[string][]string, the request headers
        #  response.url: string, the request url
        #  response.method: string, the request method
        #  response.statusCode: int, the response status code
        #  response.body: string, the response body
        #  response.headers: map[string][]string, the response headers
        successCondition: "response.body contains \"google\"" # available since v3.3
        body: "test body" # Change request body

argo submit -n argo http_template.yaml --watch

但是，我得到了以下错误：

Name:                http-template-564qp
Namespace:           argo
ServiceAccount:      unset (will run with the default ServiceAccount)
Status:              Error
Message:             failed to get token volumes: service account argo/default does not have any secrets

我不清楚为什么这不工作，因为它是直接从Quickstart文档。我会感谢你的帮助。

Answer 1

您的默认服务帐户似乎缺少凭据(kubernetes的秘密)。

通过运行kubectl get serviceaccount -n default default -o yaml，您可以通过检查它需要的证书来验证证书的存在。

kubectl get serviceaccount -n default default -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: "2022-02-10T10:48:54Z"
  name: default
  namespace: default
  resourceVersion: "*******"
  uid: ********************
secrets:
- name: default-token-*****

现在你应该可以找到附加在服务帐户上的秘密了

kubectl get secret -n default default-token-***** -o yaml

或者你可以直接跑

kubectl get secret -n default

若要查看各自命名空间中的所有秘密，请执行以下操作(在本例中，默认)

Answer 2

Argo工作流尚未与Kubernetes v1.24+一起工作。见本问题：

https://github.com/argoproj/argo-workflows/issues/8320