Workflow artifacts

A step writes a report, a plot, a CSV of the rows it rejected. Argo Workflows puts that file in your object store and records where it went. dagweave lists those files on the run that produced them and opens them in the page.

The objects stay where they are. dagweave keeps the bucket and the key, never a copy of the file.

Turn it on

Artifacts need features.artifacts in two places. Set one without the other and the connector cannot sign anything, so the run lists artifact names with no way to open them.

Set the artifacts feature on the ArgoConnection in dagweave, and set it in the connector’s Helm values:

features:
  artifacts: true

The Helm value installs the RBAC the connector needs to read your artifact repository Secret.

The connector takes the store credentials from the artifactRepoRef Secret named on its ArgoConnection. That Secret stays in your cluster. dagweave never receives the keys to your bucket.

What you see on a run

Open a run and its artifacts are listed below the steps. Each one carries the name Argo Workflows recorded, the bucket and key it went to, its size and its content type.

Click the name to download it. Click View to open it in the page.

Opening a file in the page

Reports, plots, CSVs, JSON, logs and PDFs open where you are reading the run.

An artifact is a document your workflow wrote, and a workflow can write a page with script in it. dagweave opens it in a sandbox. The document cannot read your dagweave session, cannot call the API as you, and cannot reach your cluster. Links inside it download rather than navigate.

Files above 20 MiB download instead.

Links expire

The connector signs the download link when the run reports its status, and it is good for an hour.

After that the run shows link expired beside the artifact. The bucket and key are still correct, so the object is there to fetch from your own store. Opening the file in the page does not use that link and keeps working.

Who can open an artifact

Whoever can open the run can open its artifacts. There is no separate sharing model and no second access list.

A link sent to someone without access to the run gives them a login page. Every artifact opened is written to the audit log against the run it came from.

Attaching files to a run

Artifacts go the other way too. A workflow that declares artifact arguments can be handed files when you start it, through Attach input files on the run dialog. See run on your cluster.