Hera's token handling feels a bit awkward

[ljyanesm]

Pre-bug-report checklist

1. This bug can be reproduced using pure Argo YAML

• [ ] Yes 👉 Please report a bug to the Argo Workflows GitHub 👈
• [x] No

If yes, it is more likely to be an Argo bug unrelated to Hera. Please double check before submitting an issue to Hera.

2. This bug occurs in Hera when...

• [ ] exporting to YAML
• [x] submitting to Argo
• [ ] running on Argo with the Hera runner
• [ ] other:

Bug report

Describe the bug A clear and concise description of what the bug is:

When submitting a flow, the current way the token is provided feels a bit awkward based on the way the token 'comes' from the Argo UI.

For example, on version 3.5.5 the ArgoUI will provide a token in the shape of ARGO_TOKEN="Bearer v2:<token>", which we are currently setting on the argo side by setting it as a parameter in ArgoWorkflowsServerConfig

ArgoWorkflowServerConfig(
        host=host, namespace=namespace, service_account_name=service_account_name, token=token
)

This is in turn used downstream by the create_workflow https://github.com/argoproj-labs/hera/blob/main/src/hera/workflows/service.py#L842 which contains on the Authorisation header a Bearer prefix hardcoded.

The user needs to know about this quirk to understand that the value that needs to be set for the token is actually v2:<token> which seems unexpected.

Error log if applicable:

Receiving a 401 error code when submitting the workflow

To Reproduce Full Hera code to reproduce the bug:

import os
from hera.workflows import Workflow

with Workflow(name="my-workflow") as wf:
    pass

wf.workflows_service = ArgoWorkflowServerConfig(token=os.getenv("ARGO_TOKEN"))
wf.create()

Expected behavior A clear and concise description of what you expected to happen: The above or equivalent should submit a workflow

Environment

• Hera Version: 5.14.2
• Python Version: 3.10.X
• Argo Version: 3.5.5

Additional context Add any other context about the problem here.

[Adam-D-Lewis]

I'm also hitting this issue. I want users to be able to run argo from the cli or from hera with an automatically set ARGO_WORKFLOW env var. Currently, I have to tell the CLI user to prepend 'Bearer ' or else tell the hera user to strip 'Bearer ' before using ARGO_TOKEN. I guess I could create a separate HERA_TOKEN with 'Bearer ' stripped, but it seems most natural for hera to expect the token exactly as Argo Workflows CLI expects it.

[flaviuvadan]

Thanks for reporting this @ljyanesm and @Adam-D-Lewis! See #1053