HTTP template successCondition doesn't work.

[anstjaos]

I try to use successCondition in Argo workflow http template, but it doesn't work.
SuccessCondition is visible in the workflow template, but successCondition is not visible when the actual workflow is operated.
Actual successCondition does not appear to be working.

apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: cluster-workflow-template-check-cluster-available-temp
  namespace: "{{workflow.parameters.clusterId}}"
spec:
  arguments:
    parameters:
    - name: clusterId
    - name: workers
  entrypoint: check-cluster-available
  templates:
    - name: check-cluster-available
      steps:
      - - name: check-presto-server-info-task
          template: check-presto-server-info

    - name: check-presto-server-info
      retryStrategy:
        limit: 6
        retryPolicy: "Always"
        backoff:
          duration: "10"
          factor: 1
          maxDuration: "2m"
      http:
        timeoutSeconds: 30
        successCondition: "response.statusCode == 404"
        url: "http://presto-service-{{workflow.parameters.clusterId}}.{{workflow.parameters.clusterId}}:8080/v1/info"
        method: "GET"

The picture below is what the actual workflow looks like after it runs.

The Argo version I use is v3.3.2, and the argo-events version is v1.6.3.

[wesleyscholl]

@anstjaos

In Argo Workflows v3.5.12, the same behavior is present. The template keeps {{}} variables in the manifest which is expected behavior for all workflow types. When the workflow is submitted, the parameters are passed into the workflow. I tested this workflow in v3.5.12 and this ClusterWorkflowTemplate functions as expected assuming that:

• The proper Secret, Role and RoleBinding have been configured for the service account to patch the http template workflowtasksets/status.
• The presto-service API is operational.

Without Secret, Role and RoleBinding configuration:

With Secret, Role and RoleBinding configuration:

Tested using 404 as the clusterId input parameter:

      http:
        method: GET
        url: https://httpbin.org/status/{{workflow.parameters.clusterId}}
        timeoutSeconds: 30
        successCondition: response.statusCode == 404

Example Secret, Role and RoleBinding configuration for the http template:

apiVersion: v1
kind: Secret
metadata:
  name: argo.service-account-token
  annotations:
    kubernetes.io/service-account.name: argo
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: patch-workflowtasksets
  namespace: argo
rules:
- apiGroups:
  - argoproj.io
  resources:
  - workflowtasksets/status
  verbs:
  - get
  - list
  - watch
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-patch-workflowtasksets
  namespace: argo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: patch-workflowtasksets
subjects:
- kind: ServiceAccount
  name: argo
  namespace: argo

Resources

• Argo Workflows documentation on HTTP templates
• Kubernetes RBAC documentation​
• Argo Workflows
• Argo Workflows Examples

[anstjaos]

@wesleyscholl Thanks! :)