[afonsobspinto]

Superseded by #886 on feature/CH-300. The replacement preserves this PR's file contents and uses CH-300 commit messages.

Closes https://metacell.atlassian.net/browse/CH-300

Supports MNP #1452 / NGLASS-2330.

Changes

Upgrade the vendored Argo controller, server, executor and eight official CRDs from 3.1.15 to 3.7.18. Use Emissary, remove obsolete runtime-selection/pod-worker configuration, update component/executor RBAC, and preserve POD_NAMES=v1 so existing CloudHarness log lookup continues working. Controller and server now render this from a shared podNameVersion value independently of extraEnv, with duplicate legacy entries filtered out.

This PR is independent of CloudHarness #879, which remains limited to the optional custom exit-handler command. Neither PR includes the other's implementation, and they can be merged separately. MNP ingestion needs both.

Compatibility and rollout

Public methods, caller inputs, API endpoints/response shapes and argo-workflows==5.0.0 remain unchanged. No progress endpoint or listener is introduced; consumers read native node progress through the existing SDK.

The internal compatibility fix converts integer pod-GC delay seconds to Argo duration strings, e.g. 86400 → "86400s". Argo 3.7 otherwise rejects existing numeric payloads with HTTP 400. Caller dictionaries are copied; integer TTLs, string durations and SDK-model inputs stay supported. Workflows omit empty image-pull-secret references when no registry secret is configured.

Emissary can resolve default task commands using the configured registry credentials. A dedicated namespaced Role/RoleBinding grants the actual controller service account get access only to registry.secret.name, including when a custom controller account or a cluster-scoped controller is selected.

Rebuild and deploy workflow-submitting application images with this serialization fix before upgrading Argo. Then finish active workflows, explicitly upgrade the CRDs (Helm does not upgrade existing CRDs), deploy controller/server/executor together and update downstream image pins. See the upgrade README.

Validation

• 42 local tests and nine rendering subtests pass across Argo components and existing workflow, exit-handler, and duration-serialization contracts. New coverage checks environment-list overrides, shared pod naming, configured/absent pull secrets, named-secret permission scope, and custom controller accounts.
• GitHub Actions test and lint jobs pass on commit e44bc7a.
• Helm lint passes, and the repository-wide autopep8 check produces no diff. The formatter also corrects the malformed assignment expression that caused the previous deployment CLI coverage-report failure.
• The GitHub Actions test workflow now runs Argo component compatibility tests and Helm lint before the existing tox suites.
• The combined changes previously passed finite success/failure workflows on Docker Desktop, including existing SDK submission/log retrieval and native progress.
• Combined with CH-296 Allow a custom command for workflow exit handlers #879 and MNP #1452, the retained real fixture completed 2 batches, 1,279 skeletons and 250,018 nodes/edges, with verified maps, unchanged background-project node counts and acknowledged Kafka reporting. Only expired remote object transport was substituted locally.
• Temporary test workflows, pods and storage were removed. The original local runtime was restored for existing application images. No demo rollout or microtask creation is included.

The MNP local report records the integration coverage and pending authenticated backoffice rerun.