Issue: Incorrect env Structure in initContainers Generated by Hera

[shyoon-devops]

Pre-bug-report checklist

1. This bug can be reproduced using pure Argo YAML

• Yes 👉 Please report a bug to the Argo Workflows GitHub 👈
• No

If yes, it is more likely to be an Argo bug unrelated to Hera. Please double check before submitting an issue to Hera.

2. This bug occurs in Hera when...

• exporting to YAML
• submitting to Argo
• running on Argo with the Hera runner
• other:

Bug report

Summary

When using Hera to generate an Argo Workflow, I encountered an issue with the env structure in initContainers. Specifically, the env variable references for secrets are not being properly constructed. Instead of the correct structure with valueFrom, the generated YAML output directly assigns secret_name and secret_key, which is not valid in Argo Workflows.

Reproduction Steps

Here’s a minimal example to reproduce the issue:

from hera.workflows import DAG, WorkflowTemplate, Container, SecretEnv
import hera.workflows.models as m

inject_docker_config = Container(
    name="inject-docker-config",
    image="alpine",
    command=["sh", "-c"],
    args=["ls -alrt /kaniko/.docker"],
    volume_mounts=[m.VolumeMount(name="kaniko", mount_path="/kaniko/.docker/")],
    init_containers=[UserContainer(
        name="inject-docker-config",
        image="alpine",
        command=["/bin/sh", "-c"],
        args=["echo -n \"$DOCKER_CONFIG_JSON\""],
        env=[SecretEnv(name="DOCKER_CONFIG_JSON", secret_key=".dockerconfigjson", secret_name="regcred")],
        mirror_volume_mounts=True
    )],
    readiness_probe=m.Probe(
        exec=m.ExecAction(command=["executor", "version"])
    )
)

wt = WorkflowTemplate(
    name="dag-", 
    namespace="argo", 
    entrypoint="worker",
    volumes=[
        m.Volume(name="kaniko", empty_dir=m.EmptyDirVolumeSource(medium="Memory"))
    ]
)

with wt:
    with DAG(name="worker"):
        inject_docker_config()

wt.lint()
wt.create_as_workflow()

Expected Behavior

The env section in initContainers should be generated as follows:

env:
- name: DOCKER_CONFIG_JSON
  valueFrom:
    secretKeyRef:
      key: .dockerconfigjson
      name: regcred

Actual Behavior

However, the generated YAML output is incorrect:

env:
- name: DOCKER_CONFIG_JSON
  secret_name: regcred
  secret_key: .dockerconfigjson

Cause and Suggested Fix

The issue appears to be due to the SecretEnv object not being properly converted to the expected format within the initContainers.

A workaround is to explicitly call .build() on the SecretEnv object or manually define the environment variable using m.EnvVar as follows:

env=[m.EnvVar(
    name="DOCKER_CONFIG_JSON", 
    value_from=m.EnvVarSource(
        secret_key_ref=m.SecretKeySelector(
            name="regcred", 
            key=".dockerconfigjson"
        )
    )
)]

This properly constructs the env section in the generated YAML.

Environment

• Hera Version: 5.16.2
• Python Version: 3.11
• Argo Version: 3.5.10

Conclusion

This issue likely stems from a bug in how Hera handles the conversion of SecretEnv objects within initContainers. I recommend reviewing this part of the code to ensure that the generated YAML adheres to the correct structure for Argo Workflows.

Thank you for your attention to this matter.

[flaviuvadan]

Hi @shyoon-devops, thanks for reporting this! The reason build works is because Hera doesn't call it inside its own template constructors and instead uses the init containers as they are supplied here. We need something like _build_init_containers, example, and then we need to call that inside the container constructor. Any chance you are open to submitting a PR? :)

[shyoon-devops]

Hi @flaviuvadan, thanks for the suggestion! I’ll start working on the code this week and should be able to submit a PR within a week. I’ll keep you updated! :)