Merge branch 'master' into patch-1

CONTRIBUTING.md

@@ -55,7 +55,7 @@ annotations:
 Minimally:
 
 ```
-helm install charts/argo -n argo
+helm install charts/argo-workflows -n argo
 argo version
 ```
 

charts/argo-workflows/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: argo-workflows
 description: A Helm chart for Argo Workflows
 type: application
-version: 0.2.8
+version: 0.2.10
 appVersion: "v3.0.7"
 icon: https://raw.githubusercontent.com/argoproj/argo-workflows/master/docs/assets/argo.png
 home: https://github.com/argoproj/argo-helm

charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml

@@ -121,8 +121,18 @@ rules:
   resources:
   - leases
   resourceNames:
+  {{- if .Values.controller.instanceID.enabled }}
+    {{- if .Values.controller.instanceID.useReleaseName }}
+  - workflow-controller-{{ .Release.Name }}
+  - workflow-controller-lease-{{ .Release.Name }}
+    {{- else }}
+  - workflow-controller-{{ .Values.controller.instanceID.explicitID }}
+  - workflow-controller-lease-{{ .Values.controller.instanceID.explicitID }}
+    {{- end }}
+  {{- else }}
   - workflow-controller
   - workflow-controller-lease
+  {{- end }}
   verbs:
   - get
   - watch

charts/argo-workflows/templates/controller/workflow-controller-config-map.yaml

@@ -7,11 +7,11 @@ metadata:
 data:
   config: |
     {{- if .Values.controller.instanceID.enabled }}
-    {{- if .Values.controller.instanceID.useReleaseName }}
+      {{- if .Values.controller.instanceID.useReleaseName }}
     instanceID: {{ .Release.Name }}
-    {{- else }}
+      {{- else }}
     instanceID: {{ .Values.controller.instanceID.explicitID }}
-    {{- end }}
+      {{- end }}
     {{- end }}
     containerRuntimeExecutor: {{ .Values.controller.containerRuntimeExecutor }}
     {{- if .Values.controller.parallelism }}

charts/argo-workflows/templates/controller/workflow-rb.yaml

@@ -1,19 +1,20 @@
 {{- if .Values.workflow.rbac.create -}}
+  {{- range $namespace := or .Values.singeNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq)  }}
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "argo-workflows.fullname" . }}-workflow
+  name: {{ template "argo-workflows.fullname" $ }}-workflow
-  {{- with .Values.workflow.namespace }}
+  namespace: {{ $namespace }}
-  namespace: {{ . }} 
-  {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ template "argo-workflows.fullname" . }}-workflow
+  name: {{ template "argo-workflows.fullname" $ }}-workflow
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: {{ .Values.workflow.serviceAccount.name }}
+    name: {{ $.Values.workflow.serviceAccount.name }}
-  {{- with .Values.workflow.namespace }}
+    {{- with $namespace }}
-  namespace: {{ . }}
+    namespace: {{ . }}
+    {{- end }}
   {{- end }}
 {{- end }}

charts/argo-workflows/templates/controller/workflow-role.yaml

@@ -1,25 +1,29 @@
 {{- if .Values.workflow.rbac.create -}}
+  {{- range $namespace := or .Values.singeNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq)  }}
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "argo-workflows.fullname" . }}-workflow
+  name: {{ template "argo-workflows.fullname" $ }}-workflow
-  {{- with .Values.workflow.namespace }}
+    {{- with $namespace }}
   namespace: {{ . }}
-  {{- end }}
+    {{- end }}
 rules:
-- apiGroups:
+  - apiGroups:
-  - ""
+      - ""
-  resources:
+    resources:
-  - pods
+      - pods
-  verbs:
+    verbs:
-  - get
+      - get
-  - watch
+      - watch
-  - patch
+      - patch
-- apiGroups:
+  - apiGroups:
-  - ""
+      - ""
-  resources:
+    resources:
-  - pods/log
+      - pods/log
-  verbs:
+    verbs:
-  - get
+      - get
-  - watch
+      - watch
+  {{- end }}
+
 {{- end }}

charts/argo-workflows/templates/controller/workflow-sa.yaml

@@ -1,13 +1,16 @@
 {{- if .Values.workflow.serviceAccount.create -}}
+  {{- range $namespace := or .Values.singeNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq)  }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.workflow.serviceAccount.name }}
+  name: {{ $.Values.workflow.serviceAccount.name }}
-  {{- with .Values.workflow.namespace }}
+    {{- with $namespace }}
   namespace: {{ . }}
-  {{- end }}
+    {{- end }}
-  {{- with .Values.workflow.serviceAccount.annotations }}
+    {{- with $.Values.workflow.serviceAccount.annotations }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 {{- end }}

charts/argo-workflows/values.yaml

@@ -24,13 +24,15 @@ kubeVersionOverride: ""
 singleNamespace: false
 
 workflow:
-  namespace: "" # Specify namespace if workflows run in another namespace than argo. This controls where the service account and RBAC resources will be created.
+  namespace: # Deprecated, for backwards compatibility: specify a single namespace to run workflows in
   serviceAccount:
     create: false # Specifies whether a service account should be created
     annotations: {}
     name: "argo-workflow" # Service account which is used to run workflows
   rbac:
-    create: false # adds Role and RoleBinding for the above specified service account to be able to run workflows
+    # Adds Role and RoleBinding for the above specified service account to be able to run workflows
+    # A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)
+    create: true
 
 controller:
   image:
@@ -104,6 +106,8 @@ controller:
     # Annotations applied to created service account
     annotations: {}
   name: workflow-controller
+  # Specify all namespaces to run worksflows need to be able to run in. This controls where the service
+  # account and RBAC resources will be created. If unspecified, will run in the default namespace.
   workflowNamespaces:
     - default
   containerRuntimeExecutor: docker