Are You Sure It Works? Double Check Your Workflow Spec With Validating...
summary
A validating admission webhook built with kubebuilder calls Argo’s validate.go to reject malformed Argo Workflow CRs at API-server time, catching missing template references and parameter mismatches before creation. Deployed in a multicluster, multi-datacenter platform, it stops invalid workflows from entering the system (no more 200 OK then runtime failure) but needs high availability and telemetry and a 30s timeout (heavy workflows sometimes take ~20s). Existing cluster templates must be pre-validated or the webhook can fail decoding.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:11Invalid workflows passing validation
- 3:56API server as unified entry point
- 5:00Validating webhooks solution
- 7:09Benefits of validating webhooks
- 8:13Costs and caveats of webhooks
- 9:40Final considerations
related talks
24mMulti-Branch Pipeline with Argo Workflows and CI/CD Debugging.
38mOne Definition of Valid
25mEasy notifications for Kubernetes
24mBridging Argo Notifications
30mFrom API Events To Production in Minutes: Backstage as the Front Door...
25mHitting the Runway with ArgoCD at American Airlines
45mValidating Big Data Jobs - Stopping Failures before Production
27mSupercharging Backstage Scaffolder for Workflows