feat: add cronWorkflowDefaults to controller config. Fixes #12627

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: alien2003 <alien2003@protonmail.ch>

Author: alien2003

.features/pending/12627-cron-workflow-defaults.md

@@ -0,0 +1,19 @@
+Component: CronWorkflows
+Issues: 12627
+Description: Add `cronWorkflowDefaults` to the controller ConfigMap so default `CronWorkflow` spec values can be set controller-wide
+Author: [alien2003](https://github.com/alien2003)
+
+`cronWorkflowDefaults` mirrors the existing `workflowDefaults`, but for `CronWorkflow` spec fields such as `concurrencyPolicy`, `startingDeadlineSeconds`, `successfulJobsHistoryLimit`, `failedJobsHistoryLimit` and `timezone`.
+Use it to enforce settings across every `CronWorkflow` a controller manages, for example capping the number of retained child Workflows for cost control without editing each `CronWorkflow`.
+
+A value set on the `CronWorkflow` itself always takes precedence over the default.
+Defaults are applied to the controller's in-memory copy during reconciliation and are never written back to the resource, so they do not conflict with GitOps tools that own the `CronWorkflow` manifest.
+
+```yaml
+data:
+  cronWorkflowDefaults: |
+    concurrencyPolicy: "Replace"
+    successfulJobsHistoryLimit: 4
+    failedJobsHistoryLimit: 4
+    timezone: "America/New_York"
+```

config/config.go

@@ -86,6 +86,9 @@ type Config struct {
 	// WorkflowDefaults are values that will apply to all Workflows from this controller, unless overridden on the Workflow-level
 	WorkflowDefaults *wfv1.Workflow `json:"workflowDefaults,omitempty"`
 
+	// CronWorkflowDefaults are values that will apply to all CronWorkflows from this controller, unless overridden on the CronWorkflow-level
+	CronWorkflowDefaults *wfv1.CronWorkflowSpec `json:"cronWorkflowDefaults,omitempty"`
+
 	// PodSpecLogStrategy enables the logging of podspec on controller log.
 	PodSpecLogStrategy PodSpecLogStrategy `json:"podSpecLogStrategy,omitzero"`
 

docs/default-workflow-specs.md

@@ -55,3 +55,29 @@ data:
       parallelism: 3
 
 ```
+
+## Setting Default CronWorkflow Values
+
+> v4.1 and after
+
+Default `CronWorkflow` spec values can be specified under the `cronWorkflowDefaults` key in the `workflow-controller-configmap`.
+These apply to all `CronWorkflows` executed from the controller, such as `concurrencyPolicy`, `startingDeadlineSeconds`, `successfulJobsHistoryLimit`, `failedJobsHistoryLimit` and `timezone`.
+If a `CronWorkflow` sets a value that also has a default, the `CronWorkflow`'s value takes precedence.
+See the [Field Reference](./fields.md#cronworkflowspec) for the full list of `CronWorkflowSpec` fields.
+
+Defaults are applied to the controller's in-memory copy during reconciliation and are never written back to the `CronWorkflow`, so they do not conflict with GitOps tools that manage the resource.
+
+For example, to keep at most four successful and four failed child Workflows for every `CronWorkflow`:
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: workflow-controller-configmap
+data:
+  cronWorkflowDefaults: |
+    concurrencyPolicy: "Replace"
+    successfulJobsHistoryLimit: 4
+    failedJobsHistoryLimit: 4
+    timezone: "America/New_York"
+```

docs/workflow-controller-configmap.md

@@ -86,6 +86,7 @@ Config contains the root of the configuration settings for the workflow controll
 | `Links`                    | `Array<`[`Link`](fields.md#link)`>`                                                                         | Links to related apps.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `Columns`                  | `Array<`[`Column`](fields.md#column)`>`                                                                     | Columns are custom columns that will be exposed in the Workflow List View.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `WorkflowDefaults`         | [`wfv1.Workflow`](fields.md#workflow)                                                                       | WorkflowDefaults are values that will apply to all Workflows from this controller, unless overridden on the Workflow-level                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `CronWorkflowDefaults`     | [`wfv1.CronWorkflowSpec`](fields.md#cronworkflowspec)                                                       | CronWorkflowDefaults are values that will apply to all CronWorkflows from this controller, unless overridden on the CronWorkflow-level                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `PodSpecLogStrategy`       | [`PodSpecLogStrategy`](#podspeclogstrategy)                                                                 | PodSpecLogStrategy enables the logging of podspec on controller log.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `PodGCGracePeriodSeconds`  | `int64`                                                                                                     | PodGCGracePeriodSeconds specifies the duration in seconds before a terminating pod is forcefully killed. Value must be non-negative integer. A zero value indicates that the pod will be forcefully terminated immediately. Defaults to the Kubernetes default of 30 seconds.                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `PodGCDeleteDelayDuration` | [`metav1.Duration`](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#duration-v1-meta)  | PodGCDeleteDelayDuration specifies the duration before pods in the GC queue get deleted. Value must be non-negative. A zero value indicates that the pods will be deleted immediately. Defaults to 5 seconds.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |

docs/workflow-controller-configmap.yaml

@@ -438,6 +438,14 @@ data:
         secondsAfterSuccess: 5
       parallelism: 3
 
+  # Default values that will apply to all CronWorkflows from this controller, unless overridden on the CronWorkflow-level
+  # See more: docs/default-workflow-specs.md
+  cronWorkflowDefaults: |
+    concurrencyPolicy: "Replace"
+    successfulJobsHistoryLimit: 4
+    failedJobsHistoryLimit: 4
+    timezone: "America/New_York"
+
   # SSO Configuration for the Argo server.
   # You must also start argo server with `--auth-mode sso`.
   # https://argo-workflows.readthedocs.io/en/latest/argo-server-auth-mode/

workflow/controller/controller.go

@@ -278,7 +278,7 @@ func (wfc *WorkflowController) runPodController(ctx context.Context, podGCWorker
 func (wfc *WorkflowController) runCronController(ctx context.Context, cronWorkflowWorkers int) {
 	defer runtimeutil.HandleCrashWithContext(ctx, runtimeutil.PanicHandlers...)
 
-	cronController := cron.NewCronController(ctx, wfc.wfclientset, wfc.dynamicInterface, wfc.namespace, wfc.GetManagedNamespace(), wfc.Config.InstanceID, wfc.metrics, wfc.eventRecorderManager, cronWorkflowWorkers, wfc.wftmplInformer, wfc.cwftmplInformer, wfc.Config.WorkflowDefaults)
+	cronController := cron.NewCronController(ctx, wfc.wfclientset, wfc.dynamicInterface, wfc.namespace, wfc.GetManagedNamespace(), wfc.Config.InstanceID, wfc.metrics, wfc.eventRecorderManager, cronWorkflowWorkers, wfc.wftmplInformer, wfc.cwftmplInformer, wfc.Config.WorkflowDefaults, wfc.Config.CronWorkflowDefaults)
 	cronController.Run(ctx)
 }
 

workflow/cron/controller.go

@@ -49,6 +49,7 @@ type Controller struct {
 	wftmplInformer       wfextvv1alpha1.WorkflowTemplateInformer
 	cwftmplInformer      wfextvv1alpha1.ClusterWorkflowTemplateInformer
 	wfDefaults           *v1alpha1.Workflow
+	cronWfDefaults       *v1alpha1.CronWorkflowSpec
 	cronWfQueue          workqueue.TypedRateLimitingInterface[string]
 	dynamicInterface     dynamic.Interface
 	metrics              *metrics.Metrics
@@ -76,6 +77,7 @@ func init() {
 // NewCronController creates a new cron controller
 func NewCronController(ctx context.Context, wfclientset versioned.Interface, dynamicInterface dynamic.Interface, namespace string, managedNamespace string, instanceID string, metrics *metrics.Metrics,
 	eventRecorderManager events.EventRecorderManager, cronWorkflowWorkers int, wftmplInformer wfextvv1alpha1.WorkflowTemplateInformer, cwftmplInformer wfextvv1alpha1.ClusterWorkflowTemplateInformer, wfDefaults *v1alpha1.Workflow,
+	cronWfDefaults *v1alpha1.CronWorkflowSpec,
 ) *Controller {
 	ctx, logger := logging.RequireLoggerFromContext(ctx).WithField("component", "cron").InContext(ctx)
 
@@ -89,6 +91,7 @@ func NewCronController(ctx context.Context, wfclientset versioned.Interface, dyn
 		dynamicInterface:     dynamicInterface,
 		cronWfQueue:          metrics.RateLimiterWithBusyWorkers(ctx, workqueue.DefaultTypedControllerRateLimiter[string](), "cron_wf_queue"),
 		wfDefaults:           wfDefaults,
+		cronWfDefaults:       cronWfDefaults,
 		metrics:              metrics,
 		eventRecorderManager: eventRecorderManager,
 		wftmplInformer:       wftmplInformer,
@@ -179,7 +182,7 @@ func (cc *Controller) processNextCronItem(ctx context.Context) bool {
 	}
 	ctx = wfctx.InjectObjectMeta(ctx, &cronWf.ObjectMeta)
 
-	cronWorkflowOperationCtx := newCronWfOperationCtx(ctx, cronWf, cc.wfClientset, cc.metrics, cc.wftmplInformer, cc.cwftmplInformer, cc.wfDefaults)
+	cronWorkflowOperationCtx := newCronWfOperationCtx(ctx, cronWf, cc.wfClientset, cc.metrics, cc.wftmplInformer, cc.cwftmplInformer, cc.wfDefaults, cc.cronWfDefaults)
 
 	err = cronWorkflowOperationCtx.validateCronWorkflow(ctx)
 	if err != nil {
@@ -297,7 +300,7 @@ func (cc *Controller) syncCronWorkflow(ctx context.Context, cronWf *v1alpha1.Cro
 	cc.keyLock.Lock(key)
 	defer cc.keyLock.Unlock(key)
 
-	cwoc := newCronWfOperationCtx(ctx, cronWf, cc.wfClientset, cc.metrics, cc.wftmplInformer, cc.cwftmplInformer, cc.wfDefaults)
+	cwoc := newCronWfOperationCtx(ctx, cronWf, cc.wfClientset, cc.metrics, cc.wftmplInformer, cc.cwftmplInformer, cc.wfDefaults, cc.cronWfDefaults)
 	err := cwoc.enforceHistoryLimit(ctx, workflows)
 	if err != nil {
 		return err

workflow/cron/operator.go

@@ -46,6 +46,7 @@ type cronWfOperationCtx struct {
 	wfClientset     versioned.Interface
 	wfClient        typed.WorkflowInterface
 	wfDefaults      *v1alpha1.Workflow
+	cronWfDefaults  *v1alpha1.CronWorkflowSpec
 	cronWfIf        typed.CronWorkflowInterface
 	wftmplInformer  wfextvv1alpha1.WorkflowTemplateInformer
 	cwftmplInformer wfextvv1alpha1.ClusterWorkflowTemplateInformer
@@ -57,16 +58,33 @@ type cronWfOperationCtx struct {
 	ctx context.Context
 }
 
+// applyCronWorkflowDefaults merges controller-level CronWorkflow defaults into the in-memory
+// CronWorkflow spec, leaving any field the CronWorkflow already sets untouched. It only mutates the
+// working copy: the reconcile loop never persists the spec, so defaults don't cause GitOps drift.
+// The defaults are deep-copied because MergeToCronWorkflowSpec temporarily mutates its patch argument
+// and cronWfDefaults is shared across concurrent workers.
+func applyCronWorkflowDefaults(ctx context.Context, cronWf *v1alpha1.CronWorkflow, cronWfDefaults *v1alpha1.CronWorkflowSpec) {
+	if cronWfDefaults == nil {
+		return
+	}
+	if err := util.MergeToCronWorkflowSpec(cronWfDefaults.DeepCopy(), &cronWf.Spec); err != nil {
+		logging.RequireLoggerFromContext(ctx).WithError(err).Error(ctx, "Failed to apply CronWorkflow defaults")
+	}
+}
+
 func newCronWfOperationCtx(ctx context.Context, cronWorkflow *v1alpha1.CronWorkflow, wfClientset versioned.Interface,
 	metrics *metrics.Metrics, wftmplInformer wfextvv1alpha1.WorkflowTemplateInformer,
 	cwftmplInformer wfextvv1alpha1.ClusterWorkflowTemplateInformer, wfDefaults *v1alpha1.Workflow,
+	cronWfDefaults *v1alpha1.CronWorkflowSpec,
 ) *cronWfOperationCtx {
 	log := logging.RequireLoggerFromContext(ctx)
+	applyCronWorkflowDefaults(ctx, cronWorkflow, cronWfDefaults)
 	return &cronWfOperationCtx{
 		cronWf:          cronWorkflow,
 		wfClientset:     wfClientset,
 		wfClient:        wfClientset.ArgoprojV1alpha1().Workflows(cronWorkflow.Namespace),
 		wfDefaults:      wfDefaults,
+		cronWfDefaults:  cronWfDefaults,
 		cronWfIf:        wfClientset.ArgoprojV1alpha1().CronWorkflows(cronWorkflow.Namespace),
 		wftmplInformer:  wftmplInformer,
 		cwftmplInformer: cwftmplInformer,

workflow/cron/operator_test.go

@@ -815,3 +815,46 @@ func TestEvaluateWhenUnresolvedOutside(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, result)
 }
+
+func TestApplyCronWorkflowDefaults(t *testing.T) {
+	ctx := logging.TestContext(t.Context())
+
+	newCronWf := func() *v1alpha1.CronWorkflow {
+		cronWf := &v1alpha1.CronWorkflow{}
+		v1alpha1.MustUnmarshal([]byte(scheduledWf), cronWf)
+		return cronWf
+	}
+
+	t.Run("DefaultsFillUnsetFields", func(t *testing.T) {
+		cronWf := newCronWf() // sets startingDeadlineSeconds: 30, no concurrencyPolicy
+		successLimit := int32(4)
+		defaults := &v1alpha1.CronWorkflowSpec{
+			ConcurrencyPolicy:          v1alpha1.ReplaceConcurrent,
+			SuccessfulJobsHistoryLimit: &successLimit,
+		}
+		applyCronWorkflowDefaults(ctx, cronWf, defaults)
+		assert.Equal(t, v1alpha1.ReplaceConcurrent, cronWf.Spec.ConcurrencyPolicy)
+		require.NotNil(t, cronWf.Spec.SuccessfulJobsHistoryLimit)
+		assert.Equal(t, int32(4), *cronWf.Spec.SuccessfulJobsHistoryLimit)
+		// fields set on the CronWorkflow itself are preserved
+		require.NotNil(t, cronWf.Spec.StartingDeadlineSeconds)
+		assert.Equal(t, int64(30), *cronWf.Spec.StartingDeadlineSeconds)
+		assert.Equal(t, []string{"* * * * *"}, cronWf.Spec.Schedules)
+	})
+
+	t.Run("CronWorkflowOverridesDefaults", func(t *testing.T) {
+		cronWf := newCronWf()
+		deadline := int64(120)
+		defaults := &v1alpha1.CronWorkflowSpec{StartingDeadlineSeconds: &deadline}
+		applyCronWorkflowDefaults(ctx, cronWf, defaults)
+		require.NotNil(t, cronWf.Spec.StartingDeadlineSeconds)
+		assert.Equal(t, int64(30), *cronWf.Spec.StartingDeadlineSeconds)
+	})
+
+	t.Run("NilDefaultsIsNoOp", func(t *testing.T) {
+		cronWf := newCronWf()
+		applyCronWorkflowDefaults(ctx, cronWf, nil)
+		assert.Empty(t, cronWf.Spec.ConcurrencyPolicy)
+		assert.Equal(t, []string{"* * * * *"}, cronWf.Spec.Schedules)
+	})
+}

workflow/util/merge.go

@@ -191,6 +191,70 @@ func MergeTo(patch, target *wfv1.Workflow) error {
 	return nil
 }
 
+// MergeToCronWorkflowSpec merges the "patch" CronWorkflowSpec into the "target" CronWorkflowSpec.
+// If the target defines a field, that value takes precedence over the patch. This mirrors MergeTo,
+// including the manual handling of the embedded WorkflowSpec's hooks and labelsFrom, which strategic
+// merge does not handle.
+func MergeToCronWorkflowSpec(patch, target *wfv1.CronWorkflowSpec) error {
+	if target == nil || patch == nil {
+		return nil
+	}
+
+	// Temporarily remove hooks and labelsFrom as they don't merge
+	patchHooks := patch.WorkflowSpec.Hooks
+	patch.WorkflowSpec.Hooks = nil
+	var patchLabelsFrom map[string]wfv1.LabelValueFrom
+	if patch.WorkflowSpec.WorkflowMetadata != nil {
+		patchLabelsFrom = patch.WorkflowSpec.WorkflowMetadata.LabelsFrom
+		patch.WorkflowSpec.WorkflowMetadata.LabelsFrom = nil
+	}
+
+	patchBytes, err := json.Marshal(patch)
+	patch.WorkflowSpec.Hooks = patchHooks
+	if len(patchLabelsFrom) != 0 {
+		patch.WorkflowSpec.WorkflowMetadata.LabelsFrom = patchLabelsFrom
+	}
+	if err != nil {
+		return err
+	}
+
+	targetBytes, err := json.Marshal(target)
+	if err != nil {
+		return err
+	}
+
+	mergedBytes, err := strategicpatch.StrategicMergePatch(patchBytes, targetBytes, wfv1.CronWorkflowSpec{})
+	if err != nil {
+		return err
+	}
+
+	*target = wfv1.CronWorkflowSpec{}
+	if err = json.Unmarshal(mergedBytes, target); err != nil {
+		return err
+	}
+
+	if len(patchHooks) != 0 && target.WorkflowSpec.Hooks == nil {
+		target.WorkflowSpec.Hooks = make(wfv1.LifecycleHooks)
+	}
+	for name, hook := range patchHooks {
+		// If the patch hook doesn't exist in target
+		if _, ok := target.WorkflowSpec.Hooks[name]; !ok {
+			target.WorkflowSpec.Hooks[name] = hook
+		}
+	}
+
+	if len(patchLabelsFrom) != 0 && target.WorkflowSpec.WorkflowMetadata.LabelsFrom == nil {
+		target.WorkflowSpec.WorkflowMetadata.LabelsFrom = make(map[string]wfv1.LabelValueFrom)
+	}
+	for key, val := range patchLabelsFrom {
+		// If the patch labelFrom doesn't exist in target
+		if _, ok := target.WorkflowSpec.WorkflowMetadata.LabelsFrom[key]; !ok {
+			target.WorkflowSpec.WorkflowMetadata.LabelsFrom[key] = val
+		}
+	}
+	return nil
+}
+
 // mergeMap will merge all element from right map to left map if it is not present in left.
 func mergeMap(from, to map[string]string) {
 	for key, val := range from {