Support imagePullSecrets for Executor

[jinnjwu]

Summary

When we deploy a argo-workflow in private internal datacenter, have no Internet access, we would like to pull argoproj/argoexec with a docker registry credential, but no such args in deployment yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: workflow-controller
spec:
  selector:
    matchLabels:
      app: workflow-controller
  template:
    metadata:
      labels:
        app: workflow-controller
    spec:
      containers:
      - args:
        - --configmap
        - workflow-controller-configmap   # Set configmap name here
        - --executor-image
        - argoproj/argoexec:latest
        - --namespaced
        command:
        - workflow-controller
        image: argoproj/workflow-controller:latest
        name: workflow-controller
      serviceAccountName: argo
      nodeSelector:
              kubernetes.io/os: linux

What change needs making?

Use Cases

When would you use this?

---

Message from the maintainers:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

[terrytangyuan]

You can customize your container in executor field in the controller configmap:

argo-workflows/docs/workflow-controller-configmap.yaml

Line 191 in b026a0f

# executor controls how the init and wait container should be customized

[jinnjwu]

but no imagepullsecrets can be passed on workflow-controller-configmap.

[PidgeyBE]

Is there already a solution for this?
I'm also interested to know how to apply imagePullSecrets to the executor...

[Jonilei]

Is there any solution?
I think it is an important issue because it affects the use of workflows.

[tiborauer]

Is there already an implementation for using a private registry?

[agilgur5]

imagePullSecrets are Pod-level, not container-level. The Executor is another container that runs in your template's Pods. So whatever imagePullSecrets you have on your template will be used

[tiborauer]

Thank you, @agilgur5! I already found this info on another source.