feat: Support loading parameter values from secrets. Fixes: #5506

[shuangkun]

Fixes #5506 Reference: #11446

Unsolved issues：

Hide secret value in argo template, log, UI

Motivation

Modifications

Verification

Loccal Test and UT

[terrytangyuan]

Can you paste some example outputs and screenshots?

[shuangkun]

Can you paste some example outputs and screenshots?

Sure.

1. deploy a secret

apiVersion: v1
kind: Secret
metadata:
  name: simple-parameters
  labels:
    # Note that this label is required for the informer to detect this Secret.
    workflows.argoproj.io/secret-type: Parameter
data:
  msg: "aGVsbG8gd29ybGQK"

opensource % echo "aGVsbG8gd29ybGQK" | base64 -d
hello world

2. Then we can submit a workflow to reference this secret use new cli.

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: global-parameter-values-from-secret-
  labels:
    workflows.argoproj.io/test: "true"
  annotations:
    workflows.argoproj.io/description: |
      This example demonstrates loading global parameter values from a Secret.
      Note that the "simple-parameters" Secret (defined in `examples/secrets/simple-parameters-secret.yaml`) needs to be created first before submitting this workflow.
spec:
  entrypoint: print-message
  # Parameters can also be passed via secret reference.
  arguments:
    parameters:
      - name: message
        valueFrom:
          secretKeyRef:
            name: simple-parameters
            key: msg

  templates:
    - name: print-message
      container:
        image: busybox
        command: ["echo"]
        args: ["{{workflow.parameters.message}}"]

tianshuangkun@U-4YKHFNR6-2229 opensource % /Users/tianshuangkun/go/src/github.com/argoproj/argo-workflows/dist/argo submit test.yaml
Name:                global-parameter-values-from-secret-68jb8
Namespace:           argo
ServiceAccount:      unset (will run with the default ServiceAccount)
Status:              Pending
Created:             Sun Jan 05 12:31:10 +0800 (now)
Progress:
Parameters:

3. View the results and successfully reference the secret

tianshuangkun@U-4YKHFNR6-2229 opensource % /Users/tianshuangkun/go/src/github.com/argoproj/argo-workflows/dist/argo get @latest
Name:                global-parameter-values-from-secret-rtfml
Namespace:           argo
ServiceAccount:      unset (will run with the default ServiceAccount)
Status:              Succeeded
Conditions:
 PodRunning          False
 Completed           True
Created:             Sun Jan 05 12:33:22 +0800 (26 seconds ago)
Started:             Sun Jan 05 12:33:22 +0800 (26 seconds ago)
Finished:            Sun Jan 05 12:33:30 +0800 (18 seconds ago)
Duration:            8 seconds
Progress:            1/1
ResourcesDuration:   2s*(100Mi memory),0s*(1 cpu)
Parameters:

STEP                                          TEMPLATE       PODNAME                                    DURATION  MESSAGE
 ✔ global-parameter-values-from-secret-rtfml  print-message  global-parameter-values-from-secret-rtfml  5s
tianshuangkun@U-4YKHFNR6-2229 opensource % /Users/tianshuangkun/go/src/github.com/argoproj/argo-workflows/dist/argo logs @latest
global-parameter-values-from-secret-rtfml: time="2025-01-05T04:33:26.162Z" level=info msg="capturing logs" argo=true
global-parameter-values-from-secret-rtfml: time="2025-01-05T04:33:26.163Z" level=debug msg="ignore signal child exited" argo=true
global-parameter-values-from-secret-rtfml: hello world
global-parameter-values-from-secret-rtfml:
global-parameter-values-from-secret-rtfml: time="2025-01-05T04:33:26.171Z" level=debug msg="ignore signal child exited" argo=true
global-parameter-values-from-secret-rtfml: time="2025-01-05T04:33:27.164Z" level=info msg="sub-process exited" argo=true error="<nil>"

[terrytangyuan]

This introduces a new requirement. @jessesuen Would you be okay with this addition?