Argo-Workflows配置多功能后出现CrashLoopBackoff问题排查

我们在AWS EKS上部署Argo-Workflows，需启用以下功能：Metrics、SSO、命名空间模式、S3后端工件、JSON日志格式、适配ALB和WAF的Ingress端点。此前配置可正常运行，但目前服务器陷入CrashLoopBackoff状态。

使用的values.yaml配置 #

---
server:
  serviceType: "NodePort"
  authModes:
    - sso
  secure: true
  sso:
    enabled: true
    insecureSkipVerify: true
    clientId:
      key: "client_id"
      name: "argo-server-sso"
    clientSecret:
      key: "client_secret"
      name: "argo-server-sso"
    issuer: "<some_url>"
    redirectUrl: "<some_url>/oauth2/callback"
    sessionExpiry: "1h" #  1 Hour for Session Expiration
  ingress:
    annotations:
      alb.ingress.kubernetes.io/certificate-arn: <some_cert_arn>
      alb.ingress.kubernetes.io/healthcheck-path: /
      alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
      alb.ingress.kubernetes.io/wafv2-acl-arn: <some_waf_arn>
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/ssl-redirect: "443"
      alb.ingress.kubernetes.io/subnets: <some_subnet>
      alb.ingress.kubernetes.io/tags: Environment=dev,Team=test
      alb.ingress.kubernetes.io/target-type: ip
      external-dns.alpha.kubernetes.io/hostname: <some_url>
      kubernetes.io/ingress.class: alb
    enabled: "true"
    ingressClassName: "alb"
    hosts:
      - <some_url>
    paths:
      - /*
    pathType: ImplementationSpecific
controller:
  logging:
    format: json
  metricsConfig:
    enabled: "true"
    serviceMonitor:
      enabled: "true"
    telemetryConfig:
      enabled: "true"
artifactRepositoryRef:
  artifact-repositories:
    annotations:
      workflows.argoproj.io/default-artifact-repository: default
    default:
      s3:
        bucket: <some_bucket>
        endpoint: s3.amazonaws.com
        region: us-east-1
        keyFormat: "workflow\
                    /{{workflow.creationTimestamp.Y}}\
                    /{{workflow.creationTimestamp.m}}\
                    /{{workflow.creationTimestamp.d}}\
                    /{{workflow.name}}\
                    /{{pod.name}}"
        useSDKCreds: true

部署命令 #

helm install argo-workflows argo/argo-workflows --version 0.33.1 -n arrgo-workflows

排查建议 #

• 查看服务器Pod启动日志，定位具体错误：

  kubectl logs -n arrgo-workflows <argo-server-pod-name>
  kubectl describe pod -n arrgo-workflows <argo-server-pod-name>
  

  重点关注SSO配置验证失败、S3权限不足、Ingress初始化异常等信息。
• 验证依赖资源有效性：
  • 确认SSO对应的Secret argo-server-sso存在，且包含client_id和client_secret两个有效键值对；
  • 检查Pod绑定的IAM角色是否拥有目标S3桶的读写权限；
  • 确认ALB控制器在集群中正常运行，Ingress注解中的子网、证书ARN、WAF ARN均为有效值。
• 检查版本兼容性：当前使用的Helm版本0.33.1可能存在已知bug，可尝试升级至最新稳定版本，或查阅对应版本的Release Notes确认是否有相关修复。
• 补全命名空间模式配置：当前values.yaml未显式开启命名空间模式，需添加controller.namespaceWorkflow: true配置项，确保符合部署需求。

内容的提问来源于stack exchange，提问作者R. Barrett