feat: argo-workflows and argo-events deployments (JIRA:PUC-193)

[andrrax]

This creates basic argo-workflow and argo-events deployments

• deploys argo-workflows in namespaced mode
• argo-workflows controller monitors argo-events namespace
• does not configure auth for argo-workflows
• creates a single EventSource for a webhook event on POSTs to /nautobot
• creates a single Sensor with dependency on the event described above which defines a single hello-world Workflow trigger

[cardoe]

So just playing with workflows some I think these RBACs are big and maybe not correct?

Look at this role from the docs https://github.com/argoproj/argo-workflows/blob/main/manifests/quick-start/base/webhooks/submit-workflow-template-role.yaml which should be enough for an event to trigger a workflow. They use it in the example docs.

As far as auth goes, if we're wanting to expose the workflow view we should follow https://argo-workflows.readthedocs.io/en/latest/argo-server-sso/ and create accounts in keystone which dex will serve up.

[andrrax]

Look at this role from the docs https://github.com/argoproj/argo-workflows/blob/main/manifests/quick-start/base/webhooks/submit-workflow-template-role.yaml which should be enough for an event to trigger a workflow. They use it in the example docs.

I agree, I'll revisit the RBAC roles. That said, some of the RBAC role permissions were set to provide the argo-workflows UI access to view/create Workflows and WorkflowTemplates. Additionally, because argo-workflows is configured in a namespaced scope, ClusterRoles were used to provide permissions to the clusterworkflowtemplates cluster resource to the argo-server service account within the argo namespace. I think we'll likely want to make a decision on the workflow UI and if we want to run argo-workflows in namespaced or cluster scope so we can be precise with the RBAC perms.

[andrrax]

I have review the RBAC configuration, and updated the RBAC roles with additional context. Ultimately I feel this configuration is sound and necessary when running both argo-workflows/events in a managed namespace setup.

[mfencik]

Since dex will be implemented in another PR, i'm approving this so we can move forward