Support declaration of associated objects alongside hera?

[DanCardin]

This may or may not already be possible, and thus might be a feature request if it's not.

Essentially, we use https://external-secrets.io/latest/guides/all-keys-one-secret/, where the source of pretty much every secret will translate to a Workflow. Therefore, it'd be really convenient to be able to write:

external_secret = ExternalSecret(...)
with Workflow(...) as workflow:
   Container(env=[SecretEnv(secret_name=external_secret.name, ...)])

and have hera generate yaml ... spit out the full manifest.

---

Certainly, the definition of ExternalSecret seems certainly outside the purview of hera. It maybe seems like all of the machinery leading up to self.build() in a Workflow might be useful in externally defining an ExternalSecret object?

If not, it still might seem like build, to_dict and to_yaml (and/or more) were pulled into a @runtime_checkable protocol or mixin, then the mechanisms of the cli could isinstance that instead of Workflow, and arrive at the same result?

[flaviuvadan]

The ExternalSecret is a CRD, right? If so, this is probably a combo of upstream changes to support the ExternalSecret CRD + Hera building the custom type.

I imagine this would have to be something like

with Workflow(...) as workflow:
   Container(env=[ExternalSecretEnv(secret_name=external_secret.name, ...)])

where ExternalSecretEnv is a new secret object type

[DanCardin]

yea. i also ran into something similar with Service Accounts Workflow(service_account_name=...). Where I want a one-liner of python to define the ServiceAccount, and then reference it during the Workflow definition.

I started #917 which seems like not at all the direction that you're suggesting, which seems to be more like that Workflow would react to the CRD and emit it alongside the workflow itself?

upstream changes to support the ExternalSecret CRD + Hera building the custom type.

I dont suppose there are existing examples of this sort of mechanism, or otherwise something you could point me at to attempt this myself?

[flaviuvadan]

yea. i also ran into something similar with Service Accounts Workflow(service_account_name=...). Where I want a one-liner of python to define the ServiceAccount, and then reference it during the Workflow definition.

It's already possible to set the service account name on a workflow. By this example you mean having a custom SA CRD maybe? If so, then yea the example does not apply

I dont suppose there are existing examples of this sort of mechanism, or otherwise something you could point me at to attempt this myself?

I looked through the issues of https://github.com/argoproj/argo-workflows and could not find a mention of ExternalSecret atm, maybe opening an issue would help get the convo started about contributing support for this custom CRD

[DanCardin]

By this example you mean having a custom SA CRD maybe?

Yep. Define the SA CRD in python, reference it/pass it to the service_account_name field on the workflow.

---

I had just assumed the inclusion of a random 3rd party CRD (or even if this one is established enough, then presumably there's a line somewhere) would be outside the scope of what you'd want to include inside hera. If not, then i can certainly open an issue.

I'm happy to have the definition of this object live alongside my own code, I'm mostly talking about the ability for one to author one of these and have hera react to it "correctly", where it's emitting the (yaml in my case) for it at the top-level alongside the workflow; and then the "name" at the reference point where it's used.

---

Everything else I've personally encountered in hera renders as children of the top-level Workflow type resource yaml tree, whereas these examples above arent. So if there's just some preexisting example I can reference that'd be ideal. If this is a matter of opening an issue to support defining custom external CRDs, and whatever upstream work is required to get hera to emit their definitions appropriately, i can do that.

I'd even be interested in contributing support for it, but dont know where to start.