Option to load workflow input artifacts in the wait container

[zsolt-keseru-epam]

Summary

• Provide option to switch artifact loading from a workflow step's init container to the wait container.
• Implement artifact loading status check to monitor the artifact loading
• Delay the workflow container until artifact loading finish: add post-start lifecycle hook to the wait container definition inside the PodSpec, which uses the status check and blocks the next container startup (workflow step).

This delay logic is based on istio's holdApplicationUntilProxyStarts logic:

• https://medium.com/@marko.luksa/delaying-application-start-until-sidecar-is-ready-2ec2d21a7b74
• https://github.com/istio/istio/blob/0faf5136361fa4cea96787872a024882dfc85d9d/operator/cmd/mesh/testdata/manifest-generate/output/sidecar_template.golden.yaml#L369-L376

Use Cases

• In hardened environments when Kubernetes nodes have network limitation such as they are not able to reach external network directly, only through Istio service mesh (init containers can't have istio-proxy sidecar to reach the mesh). See issue: https://github.com/argoproj/argo-workflows/issues/7209

---

Message from the maintainers:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

[sarabala1979]

@zsolt-keseru-epam I would not recommend changing the existing design instead of Workflow is already providing flexibility to add a sidecar on step/task. you can have a sidecar with a lifecycle hook that will download the artifacts.

[RafalMaleska]

@sarabala1979 would it make sense to mention somewhere in the argo-workflow docs that i does not support istio, when downloading artifacts with init containers?