Manual approve in workflows UI only by certain users/user-groups

[brian-bk]

Hello, I'd like to leverage manual approval functionality for a database migrations flow, where members can approve a database migration to move forward. However, I'd like to lock it down so that only specific, certain sets of users and/or user-groups can actually approve, not just anyone that can log in to argo workflows.

I found some related discussions but they don't specify if this functionality can be used with targeted user permissions:

• https://argo-workflows.readthedocs.io/en/latest/intermediate-inputs/ is the general flow, but doesn't talk about user-specific permissions
• Suspend workflow for long time period waiting for manual user input? #5754 talks about a "particular user", but the interaction sounds like it is via a website, not the native workflow UI+Kubernetes permissions. If there's not a native permission I may have to build something like this, though the preference is to use the out-of-the-box argo workflows UI to drive the approval step.

[brian-bk]

I received a response on the argo-workflows slack, stating that the resume api endpoint is namespace bound. So with the right combination of k8s service accounts, SSO, and leveraging a specific namespace, we should be able to achieve this.