Search code examples
persistent-volume-claimsargo-workflows

How can I properly provision a volume for argo?


I have a persistent volume running in the correct namespace:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: raw-data
spec:
  accessModes:
    - ReadWriteOnce
  capacity:
    storage: 2Gi
  hostPath: 
    path: /data
  storageClassName: storage

and would like to run a workflow that contains a volume claim template:

...
  volumeClaimTemplates:
  - metadata:
      name: raw-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 2Gi

I believe my configuration is consistent with that described here https://stackoverflow.com/a/52669115/213269 However, there are some differences since I am working on argo not kubernetes. I am receiving the following error:

 Unschedulable: 0/1 nodes are available: 1 pod has unbound immediate PersistentVolumeClaims.

Question: How do I properly provision the volume?

UPDATE:

I have tried deploying a persistent volume into the argo namespace and pointing to it from the workflow and am now getting the following error:

persistentvolumeclaims "workflow-name" is forbidden: User "system:serviceaccount:argo:argo" cannot get resource "persistentvolumeclaims" in API group "" in the namespace "argo"

I have also added a new user and context to the Kubernetes configuration to no avail.

UPDATE:

I added the following role and now the error has changed from "...User cannot get resource..." to "User cannot create resource..." Note that my user does have permission to create persistentvolumeclaims.

apiVersion: rbac.authorization.k8s.io/v1                                                                                                                                                                         kind: Role                                                                                                                                                                                                       metadata:                                                                                                                                                                                                          name: workflow                                                                                                                                                                                                   namespace: argo                                                                                                                                                                                                rules:                                                                                                                                                                                                           - apiGroups:                                                                                                                                                                                                       - ""                                                                                                                                                                                                             resources:                                                                                                                                                                                                       - pods                                                                                                                                                                                                           verbs:                                                                                                                                                                                                           - get                                                                                                                                                                                                            - list                                                                                                                                                                                                           - watch                                                                                                                                                                                                          - create                                                                                                                                                                                                         - update                                                                                                                                                                                                         - patch                                                                                                                                                                                                          - delete                                                                                                                                                                                                       - apiGroups:                                                                                                                                                                                                       - ""                                                                                                                                                                                                             resources:                                                                                                                                                                                                       - pods/log                                                                                                                                                                                                       verbs:                                                                                                                                                                                                           - get                                                                                                                                                                                                            - list                                                                                                                                                                                                           - watch                                                                                                                                                                                                          - create                                                                                                                                                                                                         - update                                                                                                                                                                                                         - patch                                                                                                                                                                                                          - delete                                                                                                                                                                                                       - apiGroups:                                                                                                                                                                                                       - ""                                                                                                                                                                                                             resources:                                                                                                                                                                                                        - persistentvolumeclaims                                                                                                                                                                                        verbs:                                                                                                                                                                                                           - get                                                                                                                                                                                                            - list                                                                                                                                                                                                           - watch                                                                                                                                                                                                          - create                                                                                                                                                                                                         - update                                                                                                                                                                                                         - patch                                                                                                                                                                                                          - delete 

Solution

  • This appears to be an RBAC problem. Make sure the service account you're submitting your workflow with has read access to volumes.