Argo S3 artifacts don't work when minio client needs to assume role

[firecast]

Pre-requisites

• I have double-checked my configuration
• I can confirm the issues exists when I tested with :latest
• I'd like to contribute the fix myself (see contributing guide)

What happened/what you expected to happen?

Expected:

• S3 artifacts would be fetched where the IAM role had to assume another role

Happened:

• Pod wait container was not able to fetch artifacts and gave error
  http://169.254.169.254/latest/api/token": context deadline exceeded

This happens if the EC2 instances is not enabled for IMDSv2 and was introduced as part of this PR on minio-go and was merged in Argo v3.4.0. It has since been fixed and released as a BugFix version v7.0.63. We will need to just update the the minio dependency to fix it.

Version

v3.4.9 and latest

Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: ghost-transform
  namespace: argo
spec:
  podGC:
    strategy: OnPodSuccess
    deleteDelayDuration: 500s
  templates:
    - name: tails
      script:
        image: python:alpine3.6
        command: [ python ]
        source: |
          with open("result.txt", "w") as f:
            f.write("it was tails")
      inputs:
        artifacts:
        - name: input
          path: "/tmp/inputs"
      outputs:
        artifacts:
          - name: result
            path: /result.txt

    - name: main
      dag:
        tasks:
          - name: run
            template: tails
            arguments:
              artifacts:
                - name: input
                  s3: # access to this artifact required the minio client to assume a role
                    bucket: "some-non-default-artifact-bucket"
                    key: "some-prefix"
                    region: "eu-central-1"
                    endpoint: "s3.eu-central-1.amazonaws.com"
                
  entrypoint: main

Logs from the workflow controller

Not relevant

Logs from in your workflow's wait container

http://169.254.169.254/latest/api/token": context deadline exceeded

[terrytangyuan]

Would you like to submit a PR to upgrade it?

[agilgur5]

This was updated in argoproj/pkg as part of argoproj/pkg#492, so just pkg needs a bump. May happen as part of #11704 (comment)

[agilgur5]

Should be fixed by #11704 now