feat(cli): virtual_host S3 addressing in athena.toml

mostlymaxi · mostlymaxi · commit 216af80cbff2 · 2026-06-10T13:13:51.000-04:00
Add `[artifact_repository.s3] virtual_host` (bool, default false =
path-style, what MinIO / most S3-compatible stores want). When true the
CLI's object_store client uses virtual-hosted-style requests; resolved
to a bool on S3Ref so publish / submit / emulate use one style for the
binary tarball and load/save_artifact objects alike.

CLI-side only for now: the in-pod Argo executor auto-detects until
upstream Argo exposes the toggle on its S3 artifact. Regenerates the
describe/ls metadata goldens (S3Ref's bool); emitted WorkflowTemplate
YAML is unchanged.
diff --git a/crates/cargo-athena-core/src/lib.rs b/crates/cargo-athena-core/src/lib.rs
@@ -680,6 +680,13 @@ pub struct S3Repo {
     pub region: String,
     #[serde(default)]
     pub insecure: bool,
+    /// `true` for virtual-hosted-style addressing (`https://<bucket>.<endpoint>/<key>`)
+    /// instead of the default path-style (`https://<endpoint>/<bucket>/<key>`).
+    /// Default false (path-style): what MinIO and most S3-compatible stores
+    /// want. CLI-side only for now; the in-pod Argo executor auto-detects
+    /// until upstream Argo exposes the toggle on its S3 artifact.
+    #[serde(default)]
+    pub virtual_host: bool,
     pub access_key_secret: SecretRef,
     pub secret_key_secret: SecretRef,
 }
@@ -884,6 +891,13 @@ pub struct S3Ref {
     pub region: String,
     pub insecure: bool,
     pub key: String,
+    /// Virtual-hosted-style addressing (else path-style). A provider-wide
+    /// property of the configured repo, carried here so the CLI's S3
+    /// client uses one addressing style for the binary tarball and for
+    /// `load`/`save_artifact!` objects alike. `#[serde(default)]`: absent
+    /// in metadata from an older binary reads as false (path-style).
+    #[serde(default)]
+    pub virtual_host: bool,
 }
 
 impl S3Ref {
@@ -899,6 +913,7 @@ impl S3Ref {
             region: repo.region.clone(),
             insecure: repo.insecure,
             key,
+            virtual_host: repo.virtual_host,
         }
     }
 }
@@ -1057,7 +1072,7 @@ impl ContainerRunMeta {
     /// Derive the runner metadata from one built Argo template.
     /// `input_types` is parallel to the template's input parameters
     /// (same order); empty when unknown.
-    fn from_template(t: &api::Template, input_types: &[&str]) -> Self {
+    fn from_template(t: &api::Template, input_types: &[&str], virtual_host: bool) -> Self {
         let kind = if t.container.is_some() {
             "container"
         } else if t.dag.is_some() || !t.steps.is_empty() {
@@ -1082,6 +1097,10 @@ impl ContainerRunMeta {
                     region: s.region.clone(),
                     insecure: s.insecure,
                     key: s.key.clone(),
+                    // The emitted Argo artifact doesn't carry an addressing
+                    // style; the configured repo's setting (threaded in)
+                    // applies to every object in that repo.
+                    virtual_host,
                 },
                 path: a.path.clone(),
             })
@@ -2418,7 +2437,11 @@ pub fn entrypoint_impl<E: Template>(
             .map(|b| {
                 let t = b(&ctx);
                 let it = collector.types.get(&t.name).copied().unwrap_or(&[]);
-                let mut m = ContainerRunMeta::from_template(&t, it);
+                let mut m = ContainerRunMeta::from_template(
+                    &t,
+                    it,
+                    ctx.config().artifact_repository.s3.virtual_host,
+                );
                 m.package = krate.to_string();
                 m.synthetic = collector.synthetic.contains(&t.name);
                 m
@@ -2451,7 +2474,11 @@ pub fn entrypoint_impl<E: Template>(
             .unwrap_or_else(|| panic!("no template named {name:?} (or {full:?})"));
         let resolved = tpl.name.clone();
         let input_types = collector.types.get(&resolved).copied().unwrap_or(&[]);
-        let mut meta = ContainerRunMeta::from_template(&tpl, input_types);
+        let mut meta = ContainerRunMeta::from_template(
+            &tpl,
+            input_types,
+            ctx.config().artifact_repository.s3.virtual_host,
+        );
         meta.package = krate.to_string();
         meta.synthetic = collector.synthetic.contains(&resolved);
         println!(
diff --git a/crates/cargo-athena/src/emulate.rs b/crates/cargo-athena/src/emulate.rs
@@ -727,6 +727,10 @@ pub(crate) fn s3_store(s3: &S3Ref) -> object_store::aws::AmazonS3 {
     let mut b = AmazonS3Builder::new()
         .with_bucket_name(&s3.bucket)
         .with_region(&s3.region)
+        // Path-style by default (object_store's default, what MinIO and
+        // most S3-compatible stores want); virtual-hosted when the repo
+        // config opts in via `[artifact_repository.s3] virtual_host`.
+        .with_virtual_hosted_style_request(s3.virtual_host)
         .with_allow_http(s3.insecure);
     // `AWS_ENDPOINT_URL` (AWS-SDK standard) overrides the config
     // endpoint — needed when S3 is reached differently from here than
diff --git a/docs/src/configuration.md b/docs/src/configuration.md
@@ -47,8 +47,15 @@ template as an Argo `s3{}` artifact source.
 | `bucket` | Bucket name. |
 | `region` | S3 region. |
 | `insecure` | `true` for plain HTTP (e.g. local MinIO). |
+| `virtual_host` | `true` for virtual-hosted-style addressing (`https://<bucket>.<endpoint>/<key>`). Default `false` = path-style (`https://<endpoint>/<bucket>/<key>`), which MinIO and most S3-compatible stores want. See note below. |
 | `access_key_secret` / `secret_key_secret` | Kubernetes `{ name, key }` secret selectors for credentials. |
 
+> `virtual_host` currently steers the **`cargo athena` CLI's** S3 client
+> only (`publish` / `submit` / `emulate`). In-pod, Argo's executor
+> auto-detects the addressing style, so set it on a provider that needs
+> virtual-hosted and confirm your cluster's Argo reaches the bucket the
+> same way. Leave it unset (path-style) for MinIO and the common case.
+
 The binary tarball's object key is `{crate}/<tag>/{bin}.tar.gz`, where
 `<tag>` is the build-time [version tag](cli.md#versioning) - the kebab of
 your crate's semver on a clean release build (`1.2.3` -> `1-2-3`), or
diff --git a/examples/smoke/tests/golden/describe_fetch.json b/examples/smoke/tests/golden/describe_fetch.json
@@ -1 +1 @@
-{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"}
+{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"}
diff --git a/examples/smoke/tests/golden/list_all.json b/examples/smoke/tests/golden/list_all.json
@@ -1 +1 @@
-[{"name":"cargo-athena-example-smoke-pipeline-ns","package":"cargo-athena-example-smoke","kind":"workflow","synthetic":false,"image":"","command":[],"args":[],"work_dir":"/athena","params":[{"name":"env","ty":"String"}],"binary_artifact":null,"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":null},{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"},{"name":"cargo-athena-example-smoke-transform","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"busybox:1.36-musl","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.data}}","{{inputs.parameters.factor}}"],"work_dir":"/athena","params":[{"name":"data","ty":"String"},{"name":"factor","ty":"i64"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":"/athena/result"}]
+[{"name":"cargo-athena-example-smoke-pipeline-ns","package":"cargo-athena-example-smoke","kind":"workflow","synthetic":false,"image":"","command":[],"args":[],"work_dir":"/athena","params":[{"name":"env","ty":"String"}],"binary_artifact":null,"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":null},{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"},{"name":"cargo-athena-example-smoke-transform","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"busybox:1.36-musl","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n  x86_64) __t=x86_64-unknown-linux-musl ;;\n  aarch64|arm64) __t=aarch64-unknown-linux-musl ;;\n  *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.data}}","{{inputs.parameters.factor}}"],"work_dir":"/athena","params":[{"name":"data","ty":"String"},{"name":"factor","ty":"i64"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":"/athena/result"}]
diff --git a/examples/smoke/tests/golden/list_if.json b/examples/smoke/tests/golden/list_if.json

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		-{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"}
	`1`	+{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n *) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"}
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		-[{"name":"cargo-athena-example-smoke-pipeline-ns","package":"cargo-athena-example-smoke","kind":"workflow","synthetic":false,"image":"","command":[],"args":[],"work_dir":"/athena","params":[{"name":"env","ty":"String"}],"binary_artifact":null,"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":null},{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n ) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"},{"name":"cargo-athena-example-smoke-transform","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"busybox:1.36-musl","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n ) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.data}}","{{inputs.parameters.factor}}"],"work_dir":"/athena","params":[{"name":"data","ty":"String"},{"name":"factor","ty":"i64"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz"},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":"/athena/result"}]
	`1`	+[{"name":"cargo-athena-example-smoke-pipeline-ns","package":"cargo-athena-example-smoke","kind":"workflow","synthetic":false,"image":"","command":[],"args":[],"work_dir":"/athena","params":[{"name":"env","ty":"String"}],"binary_artifact":null,"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":null},{"name":"cargo-athena-example-smoke-fetch","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"ghcr.io/acme/fetch:1.2.3","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n ) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.url}}"],"work_dir":"/athena","params":[{"name":"url","ty":"String"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":["/secrets/token"],"result_path":"/athena/result"},{"name":"cargo-athena-example-smoke-transform","package":"cargo-athena-example-smoke","kind":"container","synthetic":false,"image":"busybox:1.36-musl","command":["/bin/sh","-c"],"args":["set -e\ncase \"$(uname -m)\" in\n x86_64) __t=x86_64-unknown-linux-musl ;;\n aarch64\|arm64) __t=aarch64-unknown-linux-musl ;;\n ) echo \"athena: unsupported arch $(uname -m)\" >&2; exit 1 ;;\nesac\nchmod +x /athena/bin/app-$__t\nexport CARGO_ATHENA_OUTPUT=/athena/result\nexec /athena/bin/app-$__t \"$@\"\n","--","{{inputs.parameters.data}}","{{inputs.parameters.factor}}"],"work_dir":"/athena","params":[{"name":"data","ty":"String"},{"name":"factor","ty":"i64"}],"binary_artifact":{"s3":{"endpoint":"s3.amazonaws.com","bucket":"athena-artifacts","region":"us-east-1","insecure":false,"key":"cargo-athena-example-smoke/0-0-0/smoke-ns.tar.gz","virtual_host":false},"path":"/athena/bin"},"input_artifacts":[],"output_artifacts":[],"host_paths":[],"result_path":"/athena/result"}]