Argo Pipelines
You run argo pipelines by defining steps as containers in a Kubernetes manifest. A cluster controller reads this file and starts each pod in order. Most teams set up shared service accounts so these jobs can start pods. If those accounts hold broad cluster roles, a single job can change anything. One bad script can read secret keys or delete running apps across namespaces. How argo pipelines work inside your cluster The workflow engine runs as an active controller inside your Kubernetes clust
Bitbucket Pipelines Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You run argo pipelines by defining steps as containers in a Kubernetes manifest. A cluster controller reads this file and starts each pod in order. Most teams set up shared service accounts so these jobs can start pods. If those accounts hold broad cluster roles, a single job can change anything. One bad script can read secret keys or delete running apps across namespaces.
How argo pipelines work inside your cluster
The workflow engine runs as an active controller inside your Kubernetes cluster. It watches for new workflow objects that your team sends to the API. Each step in the job runs as its own isolated container pod. You can link steps together as a simple list or a graph. In a graph, you state which tasks must finish before the next starts. The controller checks pod status and schedules the next step when dependencies pass. Steps pass files to later tasks through shared cloud storage or cluster volumes. You must also attach a Kubernetes service account to every workflow run. That account needs role bindings that allow the controller to create pods. It also needs rights to read secret keys and write job status logs.
Managing permissions and secrets for workflow steps
Teams often grant one shared role to all jobs in a namespace. This makes setup fast because new steps work without extra role checks. Still, every pod in that namespace now shares the same high trust level. A test build job might hold the same rights as a deploy job. Any step can mount secret volumes that hold database keys or cloud tokens. Native cluster roles only check if a pod can mount a secret object. They do not limit how the container uses that secret once it starts. If a build script prints environment variables, sensitive keys end up in logs. You should split workflows across separate namespaces based on their risk level. Give each workflow template its own tight service account with minimal read rights. Even with small roles, static keys stored in cluster secrets create a risk. Someone must rotate those keys by hand and update every running job template.
What native cluster roles solve and what they miss
Kubernetes role bindings control who can submit or view a workflow object. They also govern which pods a workflow service account can start or stop. This native setup stops unauthorized users from launching jobs in production namespaces. Yet cluster roles only check identity when a pod starts or calls Kubernetes. They cannot see what happens inside a step when it talks to databases. Once a container reads a database key, the cluster controller steps back. The workflow engine does not check the SQL queries or commands in flight. It cannot block a rogue script from dropping tables or dumping customer rows. Native roles also cannot rewrite sensitive fields like emails or card numbers. Your cluster logs show that a pod ran, not what data it touched. To control actions inside job steps, teams need checks at the command level.
Bitbucket Pipelines Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do steps share data in an Argo workflow?
Steps share data by writing files to an audit storage or persistent volume. The controller saves output files from one pod and mounts them into the next. For tiny text values, a step can also pass standard output parameters.
What is the difference between Argo Workflows and Argo CD?
Argo Workflows runs batch jobs, data pipelines, and build tasks as sequential pods. Argo CD watches Git repos and syncs live cluster state to match those files. Many teams use Workflows to build container images and CD to deploy them.
How should we scope service accounts for pipeline pods?
Create a dedicated service account for each distinct workflow template in your cluster. Bind that account to a single namespace role instead of a cluster-wide role. Grant only the exact verbs needed to run pods and read specific secrets.